Foxit PDF Reader AcroForm Doc Use-After-Free Remote Code Execution Vulnerability
CVE-2024-9243

7.8HIGH

Key Information:

Vendor
Foxit
Status
PDF Reader
Vendor
CVE Published:
22 November 2024

Summary

A vulnerability exists in Foxit PDF Reader related to the handling of AcroForms that allows remote attackers to execute arbitrary code. This flaw stems from insufficient validation of object existence prior to performing operations, thereby enabling unauthorized code execution in the context of the current process. To exploit this vulnerability, an attacker must entice the user to visit a malicious website or open a maliciously crafted PDF file.

Affected Version(s)

PDF Reader 2024.1.0.23997

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1296/
x_research-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database
.