A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader…
Priority MEDIUM 45CWE-73Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Why it matters now
EPSS 0.03769 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Foxit | Foxit Reader | 12.1.3.15356 | — | No fix listed | CNA |
- Foxit Reader VendorFoxit Affected 12.1.3.15356 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:foxitsoftware:foxit_reader:12.1.3.15356:*:*:*:*:*:*:* | 12.1.3.15356 | Vulnerable | Foxitsoftware |
- cpe:2.3:a:foxitsoftware:foxit_reader:12.1.3.15356:*:*:*:*:*:*:* Versions 12.1.3.15356 Vulnerable ·Foxitsoftware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39542
- 2026-10-03 Alias added: GHSA-x5r2-jq66-4ccq
References
More Foxit vulnerabilities
- TI-2013-06208 Foxit Reader <= 5.4.5.0114 Plugin URL Processing Buffer Overflow CVSS 4.0CRITICAL 9.4
- TI-2009-00795 Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and… CVSS 2.0HIGH 10.0
- TI-2021-13823 Use after free in Foxit PDF Reader CVSS 3.1HIGH 7.8
- TI-2025-23518 A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of… CVSS 3.1HIGH 8.8
- TI-2024-33074 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
- TI-2024-32078 Use after free in Foxit Reader CVSS 3.1HIGH 8.8
Sources
- CVE-2023-39542 · CVE Program
- CVE-2023-39542 · NVD
- FIRST EPSS
- GHSA-x5r2-jq66-4ccq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences