CVE-2019-20827

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based color space and Alternate color space.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-208287.5An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur afteCVE-2019-208297.5An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.CVE-2019-20838.8In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additionaCVE-2019-208309.8An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used.CVE-2019-208317.5An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crCVE-2019-208324.3An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling.CVE-2019-208337.5An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive.CVE-2019-208347.5An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-stanCVE-2019-208354.3An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling.CVE-2019-208367.5An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive.CVE-2019-208377.5An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with CVE-2019-208387.5libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier,
CVE-2019-20827: Critical severity, CVSS 9.8 | Vulnix