CVE-2020-17410

Exploitation likely. EPSS gives it a 12% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.17.8High EPSS percentile96th12% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2020-10-13Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Foxit PhantomPDFAffected: 10.0.0.35798Upgrade to: not statedStated by: CVE record
Foxitsoftware Foxit ReaderAffected: ≤ 10.0.1.35811Upgrade to: after 10.0.1.35811Stated by: NVD
Foxitsoftware PhantompdfAffected: ≤ 10.0.1.35811Upgrade to: after 10.0.1.35811Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Foxit PhantomPDF or Foxit Reader version number — this issue affects version 10.0.0.35798.
Visit the Foxit security bulletins page to find the current patched release for your product.
Update PhantomPDF/Reader to the latest version offered by Foxit.
Tell staff not to open PDF or GIF attachments from unknown or unexpected senders until updated.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11135.

In plain language

Written by AI from the record

Opening a booby-trapped PDF or GIF image in old Foxit PhantomPDF (10.0.0.35798) can let an attacker run their own code on your computer, but you have to be tricked into opening the file first, and there's no sign attackers are actively using this yet.

Use-after-free (CWE-416) in PhantomPDF's GIF parsing allows arbitrary code execution in the context of the current process when a victim opens a crafted file or visits a malicious page; no public exploit or KEV listing exists yet.

If you're affected

Workstation takeover
Malware installation
Data theft from infected PC
Business disruption

What is it

Think of this like a trapped letter: if someone opens a specially rigged PDF or image file in this PDF reader, it can trick the program into running commands it shouldn't. It only works if a person actually opens the bad file — it can't break in on its own.

Who is affected

This matters to you if your business uses Foxit PhantomPDF or Foxit Reader, version 10.0.0.35798, to view or edit PDF files. It's only a risk if someone opens a malicious PDF/GIF file or visits a page that triggers the viewer to load one — there's no risk just from having the software installed and unused.

How urgent is it

No one has publicly exploited this yet and there's no exploit code circulating, so this isn't an emergency fire-drill — but a rising likelihood score means attacker interest is growing, so it's worth fixing on a near-term schedule rather than ignoring it. Treat it as a priority update, not a same-day crisis.

What to do — in detail

Confirm exposure by checking the exact build number of installed Foxit PhantomPDF/Reader clients — version 10.0.0.35798 is confirmed affected. Check Foxit's security bulletins page for the specific patched release that addresses ZDI-CAN-11135 (this CVE) and deploy it across all endpoints running PhantomPDF/Reader. There is no clean single 'fixed in X' version stated in the findings, so rely on Foxit's bulletin for the exact target build per branch. As a temporary workaround while patching is scheduled, restrict opening of untrusted PDF/GIF files (e.g., via email gateway filtering or user training) since exploitation requires user interaction. No CISA KEV deadline applies as this is not currently listed in KEV. Monitor Foxit's bulletin page and any future KEV additions or exploit-code releases, which would escalate urgency.

Technical context

CVSS 7.8 (High), AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — local attack vector requiring user interaction, no privileges needed, full confidentiality/integrity/availability impact. Weakness is CWE-416 (Use-After-Free) in GIF parsing, where the application operates on an object reference after it has been freed, enabling arbitrary code execution in the process context. Not in CISA KEV; no public exploit code known. EPSS reflects a rising likelihood of future exploitation with a high percentile ranking relative to all CVEs, though this remains a prediction, not confirmed activity. Exploit maturity is currently theoretical/PoC-level per ZDI-CAN-11135 disclosure, with no evidence of weaponization.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

12% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 2180 days, from the signal feeds we watch.

2026-10-02EPSS band change0 → moderateepss band change
2024-11-21Patch availablerecord updated
2020-10-13Publishedweakness classified, att&ck mapped

Affected products

Foxitcommercial · CNaka foxitsoftware, foxit reader, foxit software, foxit pdf
- PhantomPDFDesktop AppOn-premConsumer Software / productivity
- foxit readerDesktop AppOn-premConsumer Software / productivity
- phantompdfDesktop AppConsumer Software / productivity

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable