CVE-2018-3850

HIGH

An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed objec...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS2.8%
Percentile86th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-416: Use After Free

Software references memory after it has been freed, leading to corruption, crashes, or code execution.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A high severity vulnerability affects Foxit systems (CVE-2018-3850). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-129869-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-3850?
This vulnerability was disclosed in 2018. A high severity vulnerability affects Foxit systems (CVE-2018-3850). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-3850?
CVE-2018-3850 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 2.8%.
Is CVE-2018-3850 actively exploited?
No confirmed active exploitation of CVE-2018-3850 as of 2026-05-30.
How do I remediate CVE-2018-3850?
Priority: MEDIUM.
What systems are affected by CVE-2018-3850?
CVE-2018-3850 affects Foxit Pdf Reader.
Vulnerability Details
CVE IDCVE-2018-3850
BSIDBS-2018-GLOBAL-129869-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2018-04-23
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Use After Free
SourceNVD
Official Description

An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If a browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If a browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Foxit Pdf Reader 9.0.1.1049
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3097 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash623f781c9a5d45681c928a75b06b053e19388392c21a118b16d89e1a6316c15c80059c172acecc8fd5bdebb9a5c4c1061dc37d7670c8483d1c29410c053ee5aa
Related CVEs affecting Foxit
CVE-2009-0837 10.0 Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including ... CVE-2022-24955 9.8 Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Unc... CVE-2022-24954 9.8 Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stac... CVE-2021-38563 9.8 An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor befo... CVE-2022-28104 9.8 Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload v...
View all Foxit CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →