CVE-2018-20247: Foxit Quick PDF Library stack overflow via recursive page tree

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.8 with all-High impacts and a very high EPSS score, though exploitation requires local file processing and no KEV listing or confirmed public exploit is present.

What it is

Foxit Quick PDF Library versions prior to 16.12 mishandle malformed PDFs that contain a recursive page tree structure. Loading such a file through LoadFromFile, LoadFromString or LoadFromStream causes a stack overflow, mapped to CWE-121 and CWE-787. The flaw matters because it is reachable in any application that parses untrusted PDFs with the library.

Impact

An attacker can crash the calling process and, given the out-of-bounds write classification, potentially corrupt memory in the context of the application using the library. The CVSS 3.1 vector rates confidentiality, integrity and availability impact all High.

Attack surface

Reached locally by supplying a crafted PDF to the library's load functions; the vector AV:L/PR:N/UI:R indicates no privileges are needed but a user must open or process the malicious file. No remote or unauthenticated network path is described.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high at 0.54492 (99th percentile), but the references are only vendor and third-party advisories, so no public exploit is confirmed by this record.

What to do

• Upgrade Foxit Quick PDF Library to 16.12 or later, which the vendor advisory covers.
• Validate or reject PDFs with recursive or excessively deep page trees before passing them to LoadFromFile, LoadFromString or LoadFromStream.
• Run PDF parsing in a sandboxed or low-privilege process to limit the effect of a stack overflow or memory corruption.
• Track the vendor security bulletin page for further updates on this issue.

Detection

• Monitor for crashes or abnormal process termination in applications that embed Quick PDF Library when opening PDFs.
• Alert on PDFs with unusually deep or self-referencing page tree structures in file inspection or email gateway logs.
• Correlate endpoint crash reports with recently opened PDF files to identify malformed inputs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.