An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828.

published 2019-10-02 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-14638

cvss: 8.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 6.0%; EPSS 6.0% chance of exploitation in 30 days, percentile 93%
public exploits: 0; none known

An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted PDF document can trigger an out-of-memory condition which isn't handled properly, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Exploit prediction

6.01% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2019-0793 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

n/a Foxit

Classification

Weakness

CWE-703 Improper Check or Handling of Exceptional Conditions
CWE-770 Allocation of Resources Without Limits or Throttling

References

talosintelligence.com /vulnerability_reports/TALOS-2019-0793
exploit, third-party-advisory

Sources

CVE List CVE-2019-5031
NVD CVE-2019-5031

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary