Is CVE-2018-3956 actively exploited?

No active exploitation of CVE-2018-3956 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2018-3956 be exploited remotely?

No. CVE-2018-3956 requires local access to exploit.

What is the CVSS score of CVE-2018-3956?

CVE-2018-3956 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2018-3956

HIGH

CVE-2018-3956

CWE-125Published: January 30, 2019· Updated: Jun 17, 2026

7.1

CVSS v3.1

Official Description

An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitation when coupled with another vulnerability. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

NVD Source

Technical Analysis

CVE-2018-3956 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), availability disruption (denial of service), with a CVSS base score of 7.1.