Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-26979
CVE-2022-26979:
Foxit PDF Reader vulnerability analysis and mitigation
Overview
Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 were affected by a NULL pointer dereference vulnerability identified as CVE-2022-26979. The vulnerability was discovered in early 2022 and occurs when this.Span is used for oState of Collab.addStateModel, as this.Span.text can be NULL (MITRE CVE, Foxit Security).
Technical details
The vulnerability is characterized by a NULL pointer dereference condition that occurs specifically when this.Span is used for oState of Collab.addStateModel. The issue arises because this.Span.text can be NULL, leading to potential system instability. The vulnerability has been assigned a moderate severity rating (ManageEngine Database).
Impact
The vulnerability could potentially lead to a denial of service condition when exploited. When triggered, the NULL pointer dereference could cause the application to crash, disrupting normal operations (CERT-FR).
Mitigation and workarounds
The vulnerability was addressed in Foxit PDF Reader version 12.0.1 and PDF Editor version 12.0.1. Users are advised to upgrade to these or later versions to mitigate the risk. The fix can be obtained through the standard software update mechanism or by downloading the latest version from the Foxit website (Foxit Security).
Additional resources
Source: This report was generated using AI
Related Foxit PDF Reader vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management