Remote Code Execution Vulnerability in Foxit PDF Reader AcroForm
CVE-2023-51549

7.8HIGH

Key Information:

Vendor

Foxit
Status
PDF Editor
PDF Reader
Vendor
CVE Published:
3 May 2024

What is CVE-2023-51549?

An identified vulnerability in Foxit PDF Reader involves a use-after-free flaw within the management of Doc objects. This issue allows remote attackers to execute arbitrary code on affected installations, contingent upon user interaction. To successfully exploit this vulnerability, a user must either visit a malicious webpage or open a specially crafted PDF file that triggers the flaw. The vulnerability arises from insufficient validation of object existence before performing operations, potentially letting attackers operate within the context of the current process.

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1863/
https://www.foxit.com/support/security-bulletins.html

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.