Is CVE-2018-3960 actively exploited?

No active exploitation of CVE-2018-3960 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2018-3960 be exploited remotely?

No. CVE-2018-3960 requires local access to exploit.

What is the CVSS score of CVE-2018-3960?

CVE-2018-3960 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2018-3960

HIGH

CVE-2018-3960

CWE-416Published: October 2, 2018· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Producer property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

NVD Source

Technical Analysis

CVE-2018-3960 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.