CVE-2020-27860: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2020-27860 is a security vulnerability discovered in Foxit Reader version 10.0.1.35811. The vulnerability was identified and reported through the Zero Day Initiative (ZDI-CAN-11727). The flaw exists within the processing of XFA templates and affects Foxit Reader and PhantomPDF software (ZDI Advisory, NVD).

The vulnerability stems from the lack of proper validation of user-supplied data during XFA template processing, which can result in a write past the end of an allocated data structure. It is classified as an Out-of-bounds Write vulnerability (CWE-787). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for exploitation, where the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges but does need user interaction (NVD).

Foxit has released security updates to address this vulnerability. Users are advised to update their software to the latest version. The fix was implemented in versions after Foxit Reader 10.0.1.35811 (ZDI Advisory).