CVE-2016-3740

Name: CVE-2016-3740
Creator: NVD / NIST
Published: 2017-04-04T18:59:00.157+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 15.81%

Last modified Jun 17, 2026

CVE-2016-3740 is a vulnerability of currently unknown severity. Heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to execute arbitrary code via a large SamplesPerPixel value in a crafted TIFF image that is mishandled during PDF conversion. This is fixed in 8.0.. EPSS estimates a 15.81% chance of exploitation in the next 30 days.

Description

Heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to execute arbitrary code via a large SamplesPerPixel value in a crafted TIFF image that is mishandled during PDF conversion. This is fixed in 8.0.

Metrics

EPSS Probability

15.81%

96.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions
Foxitsoftware	Foxit Reader	7.3.4.311

References

https://0patch.blogspot.com/2016/07/0patching-foxit-readers-heap-buffer.htmlThird Party Advisory
https://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory
https://0patch.blogspot.com/2016/07/0patching-foxit-readers-heap-buffer.htmlThird Party Advisory
https://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory

Timeline

Published: Apr 4, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-3740?

How severe is CVE-2016-3740?

Severity scoring for CVE-2016-3740 is pending analysis. The EPSS model estimates a 15.81% probability of exploitation in the next 30 days.

How do I fix CVE-2016-3740?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-3740?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST