Security readout for executives and security teams
Plain-English summary
This CVE affects older Foxit Reader and PhantomPDF versions before 10.1.4. A specially structured PDF feature can trigger excessive stack use while the application handles XFA forms or link objects. The public sources do not provide severity scoring, confirmed exploitation, or broader impact details.
Executive priority
Treat this as a targeted endpoint hygiene issue rather than a confirmed emergency. Prioritize patching older Foxit installations on user workstations that routinely receive external PDFs, while noting that public severity and exploitation evidence are incomplete.
Technical view
CVE-2021-38569 describes stack consumption caused by recursive function calls in Foxit Reader and PhantomPDF before 10.1.4 when processing XFA forms or link objects. The bundle provides no CVSS, CWE, or exploit detail. Availability impact is a reasonable inference; code execution is not stated in the sources.
Likely exposure
Exposure is limited to environments running Foxit Reader or PhantomPDF versions earlier than 10.1.4. Risk is most relevant where users open untrusted or externally supplied PDF files, especially files using XFA forms or link objects.
Exploitation context
The CVE is not listed as KEV, and the supplied sources do not state active exploitation. The source text does not describe exploitability beyond triggering stack consumption during PDF object handling, so offensive feasibility and real-world use remain unclear.
Researcher notes
Key evidence gaps are CVSS, CWE classification, exploit status, and precise impact beyond stack consumption. Do not assume remote code execution from the supplied record. Validate affected versions and consult Foxit’s bulletin for the authoritative product matrix.
Mitigation direction
- Upgrade Foxit Reader and PhantomPDF to version 10.1.4 or later.
- Review Foxit security bulletins for vendor-specific remediation guidance.
- Restrict use of outdated Foxit versions for untrusted PDF files.
- Prioritize managed endpoint updates where Foxit is the default PDF handler.
Validation and detection
- Inventory endpoints for Foxit Reader and PhantomPDF installations.
- Confirm installed versions are 10.1.4 or later.
- Check whether Foxit is the default handler for PDF files.
- Review helpdesk or endpoint telemetry for Foxit crashes involving PDFs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38569 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.foxitsoftware.com/support/security-bulletins.phpCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.