CVE-2018-9958: Foxit Reader Text Annotation use-after-free allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with no privileges required and high EPSS, though it needs user interaction and is not in KEV.

What it is

Foxit Reader 9.0.1.1049 fails to validate that an object exists before operating on it when setting the point attribute of a Text Annotation, resulting in a use-after-free (CWE-416). A remote attacker can trigger the flaw through a malicious page or file, and successful exploitation runs code in the context of the current process. The record names only version 9.0.1.1049; no other affected versions are stated.

Impact

An attacker gains arbitrary code execution with the privileges of the Foxit Reader process, which can lead to full compromise of the user's session and data.

Attack surface

Reached remotely over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R): the target must visit a malicious page or open a malicious file. The flaw is in Text Annotation handling, specifically the point attribute.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.62922 (99.16th percentile), and public exploit code is referenced on Exploit-DB and Packet Storm. No ransomware group use is documented in the record.

What to do

• Update Foxit Reader and PhantomPDF to a version later than 9.0.1.1049 per the vendor security bulletins.
• If immediate patching is not possible, restrict opening of untrusted PDFs and disable or sandbox browser PDF plugins.
• Block or warn on PDFs from untrusted sources at email and web gateways.
• Run Foxit Reader with least privilege and enable OS-level exploit mitigations.
• Monitor vendor bulletins for the fixed build and verify version compliance across endpoints.

Detection

• Hunt for Foxit Reader processes spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Monitor for crashes or abnormal termination of Foxit Reader, which can indicate use-after-free exploitation attempts.
• Alert on PDF files written to temp or user directories that are immediately opened by Foxit Reader.
• Review endpoint telemetry for Foxit Reader loading unusual DLLs or making unexpected network connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.