CVE-2020-17430

Vulnerability

This vulnerability exists in Foxit Studio Photo version 3.6.6.922 during the parsing of CR2 files. The specific flaw is a lack of proper validation of user-supplied data, resulting in a write past the end of an allocated structure. This can be triggered when the user opens a malicious CR2 file or visits a malicious page that loads such a file [2].

Exploitation

An attacker must convince the target user to open a specially crafted CR2 file or navigate to a malicious page that triggers the parsing. No authentication or special network position is required; the attack is local in the sense that user interaction is necessary. The out-of-bounds write occurs during the parsing process [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process, potentially leading to full compromise of the affected system [2].

Mitigation

As of the publication date (February 2021), Foxit has not released a specific patch for this vulnerability in Foxit Studio Photo. The Foxit security bulletins page [1] does not list a fix for this CVE. Users are advised to avoid opening untrusted CR2 files and to monitor Foxit's advisory page for future updates. This CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.