CVE-2018-18933: Foxitsoftware Foxit Reader

Critical severity, CVSS 9.1. EPSS: 3% chance of exploitation in the next 30 days.

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330" issue.

Affected products

• Foxitsoftware Foxit Reader: version 9.3.0.10826 only
• Foxitsoftware u3d: version 9.3.0.10809 only

Published 2018-11-05. Last modified 2026-06-17.