CVE-2019-20820

Vulnerability

A NULL pointer dereference vulnerability exists in Foxit Reader and Foxit PhantomPDF prior to version 9.7 [1]. The bug occurs during the parsing of file data, where a crafted PDF document can trigger the dereference of a NULL pointer, leading to a crash.

Exploitation

To exploit this vulnerability, an attacker must convince a user to open a specially crafted PDF file using an affected version of Foxit Reader or PhantomPDF [1]. No authentication or special network position is required beyond delivering the file to the victim. The exploitation sequence involves the attacker crafting a malformed PDF that triggers the NULL pointer dereference during the parsing phase.

Impact

Successful exploitation results in a denial-of-service (DoS) condition due to application crash [1]. The impact is limited to availability; there is no evidence of information disclosure or arbitrary code execution in the available references.

Mitigation

The vulnerability is fixed in Foxit Reader and PhantomPDF version 9.7 [1]. Users should update to version 9.7 or later to mitigate the issue. No workarounds are documented in the available references.