CVE-2019-5126

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-51279.8A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. ExploitableCVE-2019-51289.8A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. ExploitableCVE-2019-51299.8A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. ExploitableCVE-2019-51308.8An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specCVE-2019-51318.8An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A speCVE-2019-51328.8An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of the Accusoft ImageGear 19.3.0 library. A sCVE-2019-51338.8An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library. A specially craftedCVE-2019-51347.5An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGCVE-2019-51355.3An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web applicationCVE-2019-51368.8An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A specCVE-2019-51377.5The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fCVE-2019-51389.9An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.
CVE-2019-5126: High severity, CVSS 8.8 | Vulnix