CVE-2020-8877

Vulnerability

This vulnerability exists in Foxit Studio Photo version 3.6.6.916. The flaw is within the handling of PSD files, where the software lacks proper validation of user-supplied data. This can result in a read past the end of an allocated structure, leading to an out-of-bounds read condition [1][2].

Exploitation

To exploit this vulnerability, an attacker must convince a user to visit a malicious webpage or open a malicious PSD file. No additional authentication or network position is required beyond the user interaction. The attacker does not need special privileges, as the vulnerability can be triggered by processing a crafted PSD file [1][2].

Impact

Successful exploitation allows an attacker to disclose sensitive information from the process memory of Foxit Studio Photo. While the primary impact is information disclosure, the disclosure has a low confidentiality impact (CVSS 3.3). The vulnerability may be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process [1][2].

Mitigation

As of the latest available references (2026), Foxit has released security updates for Foxit PDF Reader and Foxit PDF Editor, but not specifically for Foxit Studio Photo. The vendor's security bulletin does not mention a fix for this affected product version. Users should monitor official Foxit Studio Photo security bulletins for an update [1][2].