CVE-2018-20312: Foxitsoftware Phantompdf

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode.

Affected products

• Foxitsoftware Phantompdf: before 8.3.10 (fixed in 8.3.10); from 9.0, before 9.5 (fixed in 9.5)
• Foxitsoftware Reader: before 9.5 (fixed in 9.5)

Published 2021-01-07. Last modified 2026-06-17.