CVE-2020-17416

Think of this like a booby-trapped photo hidden inside a PDF — if someone opens the file in Foxit Reader, the hidden trap can let an attacker run their own commands on that computer. It only works if someone actually opens the malicious file, so it won't infect you just by sitting on a server.

This matters to you if your business uses Foxit Reader or Foxit PhantomPDF to open PDF files on any computer. The risk only materializes if an employee opens a malicious file sent by an attacker, so it is not something that can happen without someone clicking to open a document.

There is no confirmed evidence of attackers exploiting this in the wild and it is not on any government list of actively-exploited threats, so this is not an emergency fire-drill. That said, it allows full code execution with just a file open and no password needed, so it deserves attention and should be patched on a reasonable timeline rather than ignored.

Confirm exposure by inventorying all endpoints running Foxit Reader or Foxit PhantomPDF and checking the installed version against 10.0.0.35798 (and nearby builds from that era). Foxit has not published a specific fixed version number in the available findings — check https://www.foxitsoftware.com/support/security-bulletins.php for the exact version that resolves ZDI-CAN-11497 / CVE-2020-17416 and apply it fleet-wide. As a temporary workaround while patching is scheduled, restrict opening of PDFs/images from untrusted or external sources (email attachments, downloads) and consider disabling JPEG2000 rendering if Foxit's configuration allows it. No CISA KEV listing exists, so there is no federal remediation deadline. Monitor Foxit's security bulletins for updates on this CVE and watch endpoint/AV telemetry for anomalous process behavior following PDF opens, given the rising EPSS trend suggesting increasing attacker interest.

CVSS 3.1 score 7.8 (High), vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — local attack vector requiring user interaction but no privileges, with high impact to confidentiality, integrity, and availability. Weakness is CWE-787 (out-of-bounds write) in JPEG2000 image parsing logic, leading to memory corruption past an allocated buffer and potential arbitrary code execution in the context of the Foxit Reader process. Not present in CISA KEV; no public exploit code is currently available, placing exploit maturity at theoretical/PoC-absent stage. EPSS predicts a 12.4% likelihood of exploitation (96th percentile) with a rising trend, indicating growing attacker interest despite no confirmed in-the-wild activity. Originally disclosed via Trend Micro's Zero Day Initiative as ZDI-CAN-11497.