{"vulnerability": "cve-2018-9948", "sightings": [{"uuid": "78e85da6-23cc-47c4-80e4-2fd21dc162ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44941", "content": "", "creation_timestamp": "2018-06-25T00:00:00.000000Z"}, {"uuid": "c480e916-a445-411f-8938-8bff949d3901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "exploited", "source": "https://www.exploit-db.com/exploits/45269", "content": "", "creation_timestamp": "2018-08-27T00:00:00.000000Z"}, {"uuid": "717e32a8-45da-471b-9378-0750fb3dedab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "f6545754-5a84-4b7f-a28f-cf8148b42798", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:09.000000Z"}, {"uuid": "900e4bae-9212-45df-ae3c-c0d2148a37c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:08.000000Z"}, {"uuid": "99b96123-f7c1-480b-8087-6f2d96da252f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/foxit_reader_uaf.rb", "content": "", "creation_timestamp": "2018-08-24T00:02:58.000000Z"}, {"uuid": "79afb568-b7d5-4e3b-a604-15d48ab9cfab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9948", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/foxit_reader_uaf.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"mr_me\", \"bit from meepwn\", \"saelo\", \"Jacob Robles\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability\\n          in the Text Annotations component and the TypedArray's use\\n          uninitialized pointers.\\n\\n          The vulnerabilities can be combined to leak a vtable memory address,\\n          which can be adjusted to point to the base address of the executable.\\n          A ROP chain can be constructed that will execute when Foxit Reader\\n          performs the UAF.\\n\\n          This module has been tested on Windows 7 x64, Windows 10 Pro x64\\n          Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise\\n          must have insecure logons enabled for the exploit to work as expected.\", \"disclosure_date\": \"2018-04-20\", \"fullname\": \"exploit/windows/fileformat/foxit_reader_uaf\", \"is_install_path\": true, \"mod_time\": \"2026-03-02 14:45:14 +0000\", \"name\": \"Foxit PDF Reader Pointer Overwrite UAF\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/foxit_reader_uaf.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/fileformat/foxit_reader_uaf\", \"references\": [\"CVE-2018-9948\", \"CVE-2018-9958\", \"ZDI-18-332\", \"ZDI-18-342\", \"URL-https://srcincite.io/blog/2018/06/22/foxes-among-us-foxit-reader-vulnerability-discovery-and-exploitation.html\", \"URL-https://srcincite.io/pocs/cve-2018-99%7B48,58%7D.pdf.txt\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows 10 Pro x64 Build 17134\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:24.627024Z"}]}