Read the docs
TI-2018-14355 Aliases CVE-2018-20249GHSA-g27j-669g-qwj2

Out-of-bounds write in Foxit Quick PDF Library

Priority MEDIUM 41CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries using the DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access.

Why it matters now

EPSS 0.01445 73rd percentileScored 2026-11-07
Fix Fixed Foxit Quick PDF Library: 16.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Foxit Quick PDF Librarybefore 16.1216.12Patch availableCNA
  • Foxit Quick PDF Library Vendor— Affected before 16.12 Fixed in 16.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:foxitsoftware:quick_pdf_library:*:*:*:*:*:*:*:*before 16.12VulnerableFoxitsoftware
  • cpe:2.3:a:foxitsoftware:quick_pdf_library:*:*:*:*:*:*:*:* Versions before 16.12 Vulnerable ·Foxitsoftware

Remediation

  • Fix · CNA Foxit Quick PDF Library Fixed in 16.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20249
  2. 2026-10-03 Alias added: GHSA-g27j-669g-qwj2

References

Advisory 1

  • TI-2018-14353 Stack-based buffer overflow in Foxit Quick PDF Library CVSS 3.1HIGH 7.8
  • TI-2018-14354 Out-of-bounds write in Foxit Quick PDF Library CVSS 3.0CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences