CVE-2019-5007

HIGH

An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Disclosure and crash due to a NULL pointer dereference when reading TIFF data d...

Affects 3 products across 2 vendors.

CVSS 3.07.1
EPSS1.6%
Percentile75th
PatchPatched
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-125: Out-of-Bounds Read

Software reads data past the boundary of an allocated buffer, leaking sensitive information or causing crashes.

CWE-476: NULL Pointer Dereference

Software attempts to use a NULL pointer, causing a crash and denial of service.

Related Attack Patterns (CAPEC)
CAPEC-540 Overread Buffers
via CWE-125

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A high severity vulnerability affects Foxitsoftware systems (CVE-2019-5007). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-215094-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-5007?
This vulnerability was disclosed in 2019. A high severity vulnerability affects Foxitsoftware systems (CVE-2019-5007). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2019-5007?
CVE-2019-5007 has CVSS 7.1 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS: 1.6%.
Is CVE-2019-5007 actively exploited?
No confirmed active exploitation of CVE-2019-5007 as of 2026-05-30.
How do I remediate CVE-2019-5007?
Priority: MEDIUM. Advisory: https://www.foxitsoftware.com/support/security-bulletins.php PSIRT: [email protected]
What systems are affected by CVE-2019-5007?
CVE-2019-5007 affects Foxitsoftware Foxit Reader, Phantompdf.
Vulnerability Details
CVE IDCVE-2019-5007
BSIDBS-2019-GLOBAL-215094-H BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Published2019-01-03
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Out-of-Bounds ReadNULL Pointer Dereference
SourceNVD
Official Description

An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Disclosure and crash due to a NULL pointer dereference when reading TIFF data during TIFF parsing.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Disclosure and crash due to a NULL pointer dereference when reading TIFF data during TIFF parsing. CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Foxitsoftware Foxit Reader < 9.4
Foxitsoftware Phantompdf < 9.4

Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Microsoft Windows

Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2842 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash84f3a7f7a3b0f55d23a53c6d6325cdaf33b123ca53cbd5470fd79c7a203cb10114f19cb100955332be8bd613887669fea43784ed93bf3b3f3d23268204246ba5
Related CVEs affecting Foxitsoftware
CVE-2008-7031 10.0 Heap-based buffer overflow in Foxit Remote Access Server (aka WAC Server) 2.0... CVE-2008-0151 10.0 Heap-based buffer overflow in Foxit WAC Server 2.1.0.910, 2.0 Build 3503, and... CVE-2009-0836 10.0 Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 ... CVE-2008-7225 10.0 Heap-based buffer overflow in Foxit Remote Access Server (aka WAC Server) 2.0... CVE-2020-13814 9.8 An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a...
View all Foxitsoftware CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →