CVE-2021-31460: 
NixOS vulnerability analysis and mitigation

CVE-2021-31460 is a remote code execution vulnerability discovered in Foxit Reader version 10.1.1.37576. The vulnerability was disclosed on May 7, 2021, and affects the processing of XFA templates in the software (ZDI Advisory, NVD).

The vulnerability exists within the processing of XFA templates and results from the lack of validating the existence of an object prior to performing operations on the object. This is classified as a Use-After-Free vulnerability. The CVSS v3.1 score is 7.8 (High), with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process on affected installations of Foxit Reader. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. This requirement somewhat mitigates the ease of exploitation (ZDI Advisory).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit Reader installations to the latest version through the application's update mechanism or by downloading the latest version from the Foxit website (ZDI Advisory).