CVE-2021-40420

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Feb 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-4042210.0An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially CVE-2021-404237.5A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A sp CVE-2021-404246.5An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted exec CVE-2021-404256.5An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted exec CVE-2021-404268.8A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master comm CVE-2021-40435.5NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.CVE-2021-404389.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apa CVE-2021-404396.5Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expans CVE-2021-40447.5Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may ret CVE-2021-404405.4Microsoft Dynamics Business Central Cross-site Scripting Vulnerability CVE-2021-404417.8Windows Media Center Elevation of Privilege Vulnerability CVE-2021-404427.8Microsoft Excel Remote Code Execution Vulnerability