Security readout for executives and security teams
Plain-English summary
Foxit Reader and PhantomPDF versions before 9.6 contain a flaw triggered by an EPUB file. The public record describes a NULL pointer dereference, which commonly causes an application crash. The sources do not provide CVSS, detailed impact, or evidence of broader compromise.
Executive priority
Prioritize as routine endpoint hygiene unless local exposure is widespread or EPUB handling is business-critical. The public evidence supports patching, but not emergency response.
Technical view
CVE-2019-20829 is a NULL pointer dereference in Foxit Reader and PhantomPDF before 9.6, reached through FXSYS_wcslen while processing an EPUB file. Public data does not name a CWE, CVSS score, proof of exploitation, or detailed attack preconditions beyond EPUB parsing.
Likely exposure
Exposure is most likely on endpoints running Foxit Reader or PhantomPDF earlier than 9.6, especially where users can open EPUB files from email, downloads, or shared drives.
Exploitation context
The CVE is not listed as CISA KEV in the supplied data. The provided sources do not state active exploitation, exploit availability, or weaponized use. Treat exploitation status as unconfirmed.
Researcher notes
Evidence is sparse: no CVSS, CWE, exploit status, or vendor advisory detail is included beyond the Foxit bulletin reference. Avoid assuming code execution or privilege impact without additional vendor confirmation.
Mitigation direction
- Inventory Foxit Reader and PhantomPDF versions across managed endpoints.
- Upgrade affected installations to Foxit version 9.6 or later.
- Check Foxit security bulletins for current vendor guidance.
- Restrict handling of untrusted EPUB files where upgrades are delayed.
Validation and detection
- Confirm whether any Foxit Reader or PhantomPDF installs are below 9.6.
- Verify upgraded endpoints report version 9.6 or later.
- Review endpoint telemetry for repeated Foxit crashes involving EPUB files.
- Document exceptions where unsupported Foxit versions remain installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20829 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.foxitsoftware.com/support/security-bulletins.phpCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.