CVE-2021-40326

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory
https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-403275.9Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto CVE-2021-403299.8The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.CVE-2021-40336.5kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-403307.5git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cr CVE-2021-403318.1An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT priv CVE-2021-403337.1Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communic CVE-2021-403347.5Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that CVE-2021-403358.8A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent re CVE-2021-403368.8A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HT CVE-2021-403375.4Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take adv CVE-2021-403385.3Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path CVE-2021-403397.5Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploi