CVE-2021-27266: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2021-27266 is a vulnerability discovered in Foxit PhantomPDF version 10.1.0.37527 that allows remote attackers to disclose sensitive information. The vulnerability requires user interaction, specifically requiring the target to visit a malicious page or open a malicious file (Zero Day Initiative, NVD).

The vulnerability exists within the handling of U3D objects embedded in PDF files. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (NVD).

When exploited, this vulnerability allows attackers to disclose sensitive information. The vulnerability can potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

Foxit has issued an update to correct this vulnerability. Users are advised to update their software to the latest version through the vendor's security bulletin (Foxit Security Bulletin).