CVE-2021-40326 json
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed docu…
published 2022-08-29 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27506
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification.
Patch / fix
- foxit pdf_editor 11.1
- foxit pdf_reader 11.1
- foxit phantompdf 10.1.6
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
foxit.com
/support/security-bulletins.html
vendor-advisory
Sources
- CVE List CVE-2021-40326
- NVD CVE-2021-40326
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.