CVE-2016-8878

Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka "Data from Faulting Address may be used as a return value starting at FOXITREADER."

• CWE-125

• http://www.securityfocus.com/bid/93608Third Party Advisory, VDB Entry
• https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/93608Third Party Advisory, VDB Entry
• https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory

Published

Oct 31, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8869The register method in the UsersModelRegistration class in c…
• CVE-2016-8870The register method in the UsersModelRegistration class in c…
• CVE-2016-8871In Botan 1.11.29 through 1.11.32, RSA decryption with certai…
• CVE-2016-8875The ConvertToPDF plugin in Foxit Reader and PhantomPDF befor…
• CVE-2016-8876Out-of-Bounds read vulnerability in Foxit Reader and Phantom…
• CVE-2016-8877Heap buffer overflow (Out-of-Bounds write) vulnerability in …
• CVE-2016-8879The thumbnail shell extension plugin (FoxitThumbnailHndlr_x8…
• CVE-2016-8880Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-8881Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-8882The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in …
• CVE-2016-8883The jpc_dec_tiledecode function in jpc_dec.c in JasPer befor…
• CVE-2016-8884The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPe…