CVE-2018-3956: Foxit PDF Reader XFA attribute out-of-bounds read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.1) with a public exploit reference and very high EPSS percentile, though it requires user interaction and only leaks memory.

What it is

Foxit Software's PDF Reader 9.1.0.5096 mishandles certain XFA element attributes, causing an out-of-bounds read. A crafted PDF can leak sensitive memory contents, which aids exploitation when chained with another flaw. The record names only version 9.1.0.5096, so other versions cannot be confirmed as affected or fixed from the data given.

Impact

An attacker gains disclosure of memory contents from the reader process, which can expose sensitive data and provide information useful for a follow-on exploit. The out-of-bounds read alone does not give code execution.

Attack surface

Reached by opening a malicious PDF, requiring user interaction to trick the victim into opening the file; if the browser plugin extension is enabled, visiting a malicious site can also trigger it. No authentication or privileges are needed (PR:N, UI:R, AV:L).

Exploitation

Not listed in CISA KEV, but EPSS is 0.46008 (98.75th percentile), indicating elevated predicted exploitation activity. Both references are tagged Exploit and Third Party Advisory, so public exploit detail exists.

What to do

• Update Foxit Reader and PhantomPDF to a version later than 9.1.0.5096; the record does not state the fixed version, so confirm with the vendor advisory.
• Disable or remove the browser plugin extension to close the drive-by path.
• Block or sandbox untrusted PDF attachments and downloads at the mail and web gateway.
• Restrict PDF handling to a hardened or isolated viewer for untrusted documents.
• Monitor Foxit vendor advisories for the patched release and track deployment.

Detection

• Hunt for Foxit Reader or PhantomPDF crashes or abnormal exits tied to XFA-heavy PDFs.
• Alert on PDFs containing XFA element attributes from untrusted sources reaching endpoints.
• Correlate process-level memory read anomalies or exploit-protection events in the reader process.
• Track reader version inventory to find hosts still on 9.1.0.5096.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.