CVE-2020-27856
Description
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11434.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
CVE-2020-27856 is an out-of-bounds read in Foxit Studio Photo 3.6.6.922 during CR2 parsing, enabling information disclosure or code execution when chained with other vulnerabilities.
Vulnerability
The vulnerability exists in Foxit Studio Photo version 3.6.6.922 [2]. It occurs during the parsing of specially crafted CR2 files. The lack of proper validation of user-supplied data leads to a read past the end of an allocated structure, resulting in an out-of-bounds read [2].
Exploitation
Exploitation requires user interaction: the target must visit a malicious page or open a malicious CR2 file [2]. No authentication is needed. An attacker can craft a CR2 file that triggers the out-of-bounds read when processed by Foxit Studio Photo [2].
Impact
A successful exploit allows an attacker to disclose sensitive information from process memory [2]. The ZDI advisory notes that this can be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process [2].
Mitigation
No specific mitigation or patched version is mentioned in the available references [1][2]. Users should monitor Foxit's security bulletins for updates. As of the publication date, no fix has been released for Foxit Studio Photo.
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: =3.6.6.922
- Foxit/Studio Photov5Range: 3.6.6.922
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.foxitsoftware.com/support/security-bulletins.htmlmitrex_refsource_MISC
- www.zerodayinitiative.com/advisories/ZDI-20-1349/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.