Skip to content
CVE Tracker
Back

CVE-2019-5145

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted…

High8.8EPSS 3.1%
Published
Updated
Reserved
Assigned by
talos

Description

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Scores

CVSS scores of CVE-2019-5145, by who scored it
Scored byCVSSScoreVector
talosCNA (assigner)3.0High8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
3.1% · top 12% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Affected products

  • Foxit

    • affected Foxit Software Foxit PDF Reader 9.7.0.29435

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .