CVE-2020-8879

Vulnerability

Foxit Studio Photo version 3.6.6.916 contains an out-of-bounds read vulnerability in the handling of PSD files. The issue arises due to improper validation of user-supplied data, allowing a read past the end of an allocated structure. User interaction is required; the target must open a malicious PSD file or visit a malicious page. [2]

Exploitation

An attacker can exploit this vulnerability by crafting a malicious PSD file and convincing the user to open it (e.g., via email or web download). The flaw is triggered during the parsing of the PSD file, leading to an out-of-bounds read. No additional privileges are required, as the vulnerability is in the parsing logic. [2]

Impact

Successful exploitation results in the disclosure of sensitive information from the application's memory. An attacker can leverage this information disclosure in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. The CVSS score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). [2]

Mitigation

As of the publication date of this CVE, no official fix has been released for Foxit Studio Photo 3.6.6.916. The vendor's security bulletin does not address this specific vulnerability. [1] Users should exercise caution when opening PSD files from untrusted sources and consider using alternative software until a patch is available.