{"vulnerability": "cve-2018-9958", "sightings": [{"uuid": "abfe4e49-84ea-4b19-8d91-e5141e4360c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9958", "type": "exploited", "source": "https://www.exploit-db.com/exploits/45269", "content": "", "creation_timestamp": "2018-08-27T00:00:00.000000Z"}, {"uuid": "9f078eb5-9124-48fc-95c2-93333aa1eb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9958", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44941", "content": "", "creation_timestamp": "2018-06-25T00:00:00.000000Z"}, {"uuid": "701e6024-d7f4-419b-9f38-8d08f8f17c0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9958", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "07a5e71f-82b6-4d11-9c07-b1dd77d7a063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9958", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:09.000000Z"}, {"uuid": "09ffcb1f-eb17-42c9-b71f-7246b098faa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9958", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/foxit_reader_uaf.rb", "content": "", "creation_timestamp": "2018-08-24T00:02:58.000000Z"}, {"uuid": "28918397-97f7-4664-99cf-65959984223c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9958", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/foxit_reader_uaf.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"mr_me\", \"bit from meepwn\", \"saelo\", \"Jacob Robles\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability\\n          in the Text Annotations component and the TypedArray's use\\n          uninitialized pointers.\\n\\n          The vulnerabilities can be combined to leak a vtable memory address,\\n          which can be adjusted to point to the base address of the executable.\\n          A ROP chain can be constructed that will execute when Foxit Reader\\n          performs the UAF.\\n\\n          This module has been tested on Windows 7 x64, Windows 10 Pro x64\\n          Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise\\n          must have insecure logons enabled for the exploit to work as expected.\", \"disclosure_date\": \"2018-04-20\", \"fullname\": \"exploit/windows/fileformat/foxit_reader_uaf\", \"is_install_path\": true, \"mod_time\": \"2026-03-02 14:45:14 +0000\", \"name\": \"Foxit PDF Reader Pointer Overwrite UAF\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/foxit_reader_uaf.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/fileformat/foxit_reader_uaf\", \"references\": [\"CVE-2018-9948\", \"CVE-2018-9958\", \"ZDI-18-332\", \"ZDI-18-342\", \"URL-https://srcincite.io/blog/2018/06/22/foxes-among-us-foxit-reader-vulnerability-discovery-and-exploitation.html\", \"URL-https://srcincite.io/pocs/cve-2018-99%7B48,58%7D.pdf.txt\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows 10 Pro x64 Build 17134\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:24.700865Z"}]}