CVE-2020-13812

Vulnerability

Foxit Studio Photo versions before 3.6.6.922 are vulnerable to a DLL hijacking attack. The application loads a DLL from the current working directory without proper validation, allowing an attacker to place a malicious DLL that will be executed with the privileges of the application.

Exploitation

An attacker with local access can place a crafted DLL in the current working directory from which Foxit Studio Photo is launched. When the application loads, it will load the malicious DLL instead of the legitimate one, leading to code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the Foxit Studio Photo process, potentially leading to privilege escalation and full control over the affected system.

Mitigation

Foxit has addressed this issue in version 3.6.6.922. Users should update to this version or later. No workaround is available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.