CVE-2018-21241: 
Foxit PhantomPDF vulnerability analysis and mitigation

An issue was discovered in Foxit PhantomPDF before version 8.3.6 that contains an untrusted search path vulnerability. This vulnerability allows attackers to execute remote code through DLL execution (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 Base Score is 4.4 (MEDIUM) with the vector (AV:L/AC:M/Au:N/C:P/I:P/A:P). The vulnerability is classified under CWE-426 (Untrusted Search Path) (NVD).

The vulnerability could allow attackers to execute remote code through DLL execution, potentially leading to unauthorized access, data manipulation, and system compromise. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L). No privileges are required (PR:N), but user interaction is needed (UI:R). The scope is unchanged (S:U), indicating the impact is limited to the vulnerable component (NVD).

Users should upgrade to Foxit PhantomPDF version 8.3.6 or later to address this vulnerability. The fix is available through the vendor's security bulletin (Vendor Advisory).