CVE-2020-26540: 
Foxit PDF Reader vulnerability analysis and mitigation

An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing, code injection (or an information leak) can occur (Foxit Advisory, SecurityWeek).

The vulnerability has been assigned CVE-2020-26540 with a CVSS v2.0 base score of 5.0 (Medium). The issue stems from the lack of Hardened Runtime protection during code signing in the macOS versions of the software, which could potentially allow unauthorized code execution or information disclosure (NVD).

The vulnerability could result in code injection or information disclosure on affected systems. This poses a security risk as attackers could potentially execute unauthorized code or access sensitive information on targeted macOS systems running the vulnerable versions of Foxit Reader and PhantomPDF (SecurityWeek).

The vulnerability affects Foxit PhantomPDF Mac version 4.0.0.0430 and earlier and Foxit Reader Mac version 4.0.0.0430 and earlier. The issue requires local access to exploit (SecurityWeek).

Foxit has released patches to address this vulnerability. Users should update to Foxit PhantomPDF Mac and Foxit Reader Mac version 4.1 or later to resolve the issue (Foxit Advisory, SecurityWeek).