CVE-2021-33792
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by exploiting an out-of-bounds write vulnerability in Foxit Reader and PhantomPDF when processing PDF files with a crafted /Size key in the Trailer dictionary. Users of Foxit Reader or PhantomPDF versions before 10.1.4 are affected.
💻 Affected Systems
- Foxit Reader
- Foxit PhantomPDF
📦 What is this software?
Foxit Reader by Foxitsoftware
Phantompdf by Foxitsoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or limited code execution within the context of the PDF reader process.
If Mitigated
Application crash without code execution if memory protections are enabled.
🎯 Exploit Status
Exploitation requires user to open a malicious PDF file. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.1.4 and later
Vendor Advisory: https://www.foxitsoftware.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Download Foxit Reader/PhantomPDF 10.1.4 or later from official website. 2. Run installer. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
allDisable JavaScript execution in Foxit Reader/PhantomPDF to reduce attack surface
Open Foxit > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use Protected View
allEnable Protected View to open PDFs in sandboxed environment
Open Foxit > File > Preferences > Trust Manager > Check 'Enable Protected View'
🧯 If You Can't Patch
- Restrict PDF file opening to trusted sources only
- Use alternative PDF readers that are not vulnerable
🔍 How to Verify
Check if Vulnerable:
Check Foxit version in Help > About Foxit Reader/PhantomPDFCheck Version:
On Windows: wmic product where name like "Foxit%" get versionVerify Fix Applied:
Verify version is 10.1.4 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes of Foxit Reader/PhantomPDF
- Unusual process creation from Foxit executables
Network Indicators:
- Downloads of PDF files from suspicious sources
- Unusual outbound connections from Foxit processes
SIEM Query:
process_name:"FoxitReader.exe" AND (event_id:1000 OR event_id:1001) OR process_parent_name:"FoxitReader.exe" AND process_name:"cmd.exe"