CVE-2021-27265: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2021-27265 is a vulnerability affecting Foxit PhantomPDF version 10.1.0.37527. The vulnerability allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file (NVD, ZDI Advisory).

The vulnerability exists within the handling of U3D objects embedded in PDF files. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (LOW) with the vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (NVD).

When successfully exploited, this vulnerability can lead to sensitive information disclosure. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

Foxit has released updates to address this vulnerability. Users are recommended to upgrade to the most current supported version of the software. The fix is available through Foxit's security bulletin (Foxit Security).