Read the docs
TI-2015-07278 Aliases CVE-2015-8843GHSA-rw82-83m8-mfj2

The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through…

Priority LOW 33CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption.

Why it matters now

EPSS 0.00656 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:foxitsoftware:foxit_reader:6.1:*:*:*:*:*:*:*6.1VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:6.1.2:*:*:*:*:*:*:*6.1.2VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:6.1.4:*:*:*:*:*:*:*6.1.4VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:6.2:*:*:*:*:*:*:*6.2VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:7.0:*:*:*:*:*:*:*7.0VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:7.0.6:*:*:*:*:*:*:*7.0.6VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:7.1.5:*:*:*:*:*:*:*7.1.5VulnerableFoxitsoftware
cpe:2.3:a:foxitsoftware:foxit_reader:7.2:*:*:*:*:*:*:*7.2VulnerableFoxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:6.1.2:*:*:*:*:*:*:* Versions 6.1.2 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:6.1.4:*:*:*:*:*:*:* Versions 6.1.4 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:7.1.5:*:*:*:*:*:*:* Versions 7.1.5 Vulnerable ·Foxitsoftware
  • cpe:2.3:a:foxitsoftware:foxit_reader:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Foxitsoftware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-8843
  2. 2026-10-03 Alias added: GHSA-rw82-83m8-mfj2
  3. 2026-10-12 EPSS moved to the 50th–90th percentile

References

Patch 1

Other 1

  • TI-2020-10635 Use after free in Foxit CVSS 3.1HIGH 8.8
  • TI-2020-10626 Use after free in Foxit CVSS 3.1HIGH 8.8
  • TI-2023-21064 An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of… CVSS 3.1HIGH 8.8
  • TI-2023-19948 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
  • TI-2023-18045 An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of… CVSS 3.1HIGH 8.8
  • TI-2018-07063 Use after free in Foxit Reader CVSS 3.0HIGH 8.8
See all 371 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences