Local Privilege Escalation Vulnerability in Foxit PDF Reader
CVE-2024-12753

7.3HIGH

Key Information:

Vendor

Foxit
Status
PDF Reader
Vendor
CVE Published:
30 December 2024

What is CVE-2024-12753?

A local privilege escalation vulnerability has been identified in Foxit PDF Reader, which can be exploited by attackers to gain elevated privileges on affected systems. This issue arises from a flaw within the product's installer that can be manipulated by creating a junction. By exploiting this vulnerability, an attacker who has already executed low-privileged code on the target system may achieve arbitrary code execution with SYSTEM-level privileges. Users are advised to ensure their installations are updated to mitigate potential risks associated with this vulnerability.

Affected Version(s)

PDF Reader 2024.2.3.25184

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1739/
x_research-advisory
https://www.foxit.com/support/security-bulletins.html
vendor-advisory

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.