Security readout for executives and security teams
Plain-English summary
This CVE affects older macOS Foxit PDF Editor and PDF Reader versions before 11.0.1. A malformed document condition can cause the application to hit a NULL pointer dereference. The public sources do not provide a CVSS score or evidence of active exploitation, so urgency depends on whether vulnerable Foxit versions remain deployed.
Executive priority
Treat this as a patch hygiene issue unless vulnerable Foxit installations are widespread or used to process untrusted PDFs. There is no cited active exploitation, but outdated PDF software remains a practical exposure point for document-driven attacks.
Technical view
Foxit PDF Editor and PDF Reader before 11.0.1 on macOS mishandle missing dictionary entries, resulting in a NULL pointer dereference. The source bundle names CNVD-C-2021-95204. No CWE, CVSS vector, exploitability detail, or broader platform impact is provided in the cited sources.
Likely exposure
Exposure is limited to macOS systems running Foxit PDF Editor or Foxit PDF Reader versions earlier than 11.0.1. The source bundle does not provide CPEs or detailed edition mapping, so asset validation should rely on installed application inventory and Foxit guidance.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The documented impact is a NULL pointer dereference, which commonly causes application instability or denial of service, but the sources do not establish code execution or real-world exploitation.
Researcher notes
The record is sparse: severity, CVSS, CWE, CPEs, and exploit status are absent. Analysis should stay anchored to the named products, macOS scope, versions before 11.0.1, and the NULL pointer dereference caused by missing dictionary entries.
Mitigation direction
- Upgrade macOS Foxit PDF Editor to version 11.0.1 or later.
- Upgrade macOS Foxit PDF Reader to version 11.0.1 or later.
- Review Foxit security bulletins for product-specific remediation guidance.
- Prioritize systems that open untrusted or externally supplied PDF files.
Validation and detection
- Inventory macOS endpoints for Foxit PDF Editor and Reader installations.
- Confirm installed Foxit versions are 11.0.1 or later.
- Check vulnerability records against endpoint software inventory.
- Document exceptions where Foxit cannot be updated immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38567 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.foxitsoftware.com/support/security-bulletins.phpCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.