CVE-2020-10913: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2020-10913 is a remote code execution vulnerability affecting Foxit PhantomPDF version 9.7.0.29478. The vulnerability was discovered and reported by Mat Powell of Trend Micro Zero Day Initiative. The issue was disclosed on April 16, 2020, after being initially reported to the vendor on December 27, 2019 (ZDI Advisory).

The vulnerability exists within the handling of the OCRAndExportToExcel command of the communication API. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') (NVD).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. The successful exploitation requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction to exploit, where the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges, but does need user interaction for successful exploitation (NVD).

Foxit has issued an update to correct this vulnerability. Users should update their installations to version 9.7.1.29511 or later to address this security issue (ZDI Advisory).