CVE-2021-27262: 
Foxit PDF Reader vulnerability analysis and mitigation

This vulnerability (CVE-2021-27262) affects Foxit PhantomPDF version 10.1.0.37527. The vulnerability allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file (MITRE CVE, ZDI Advisory).

The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low) with the vector: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The vulnerability is classified as an Out-of-bounds Read (CWE-125) (ZDI Advisory).

An attacker can leverage this vulnerability to disclose sensitive information. Additionally, this vulnerability could potentially be combined with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

Foxit has issued an update to correct this vulnerability. Users are advised to update to the latest version of the software through the official Foxit website (Foxit Security Bulletin).