Read the docs
TI-2023-15941 Aliases CVE-2023-32664GHSA-xpg9-vvh4-vqjv

Type confusion in Foxit Reader

Priority HIGH 73CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00997 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FoxitFoxit Reader12.1.2.15332—No fix listedCNA
  • Foxit Reader VendorFoxit Affected 12.1.2.15332 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:foxit:pdf_reader:12.1.2.15332:*:*:*:*:*:*:*12.1.2.15332VulnerableFoxit
  • cpe:2.3:a:foxit:pdf_reader:12.1.2.15332:*:*:*:*:*:*:* Versions 12.1.2.15332 Vulnerable ·Foxit

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32664
  2. 2026-10-03 Alias added: GHSA-xpg9-vvh4-vqjv

References

Exploit 1

  • TI-2021-13823 Use after free in Foxit PDF Reader CVSS 3.1HIGH 7.8
  • TI-2025-23518 A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of… CVSS 3.1HIGH 8.8
  • TI-2024-33074 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
  • TI-2024-32078 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
  • TI-2024-19083 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
  • TI-2024-17038 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
See all 372 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences