CVE-2023-51553

CVE-2023-51553 : Foxit PDF Reader/Editor is affected by an Out-of-Bounds Read in the Bookmark handling, caused by improper validation of bookmark data. This can lead to disclosure of sensitive information and, in conjunction with other vulnerabilities, may enable arbitrary code execution in the c...

CVE-2022-28682

CVE-2022-28682 affects Foxit PDF Reader 11.2.1.53537. The issue lies in Doc object handling where JavaScript actions can trigger a read past the end of an allocated object, enabling remote code execution in the context of the current process after user interaction (visiting a malicious page or op...

CVE-2022-24367

Foxit PDF Reader 11.1.0.52543 is affected by a vulnerability in AcroForms where the software fails to validate the existence of an object before performing operations, enabling remote code execution in the context of the current process when a user opens a malicious page or file. Exploitation req...

CVE-2022-28676

Foxit PDF Reader 11.2.1.53537 is affected by a Doc object handling flaw that allows code execution when a user opens a malicious file or visits a malicious page. The vulnerability (CVE-2022-28676) requires user interaction and can execute code in the current process context; exploit referenced as...

CVE-2023-51551

CVE-2023-51551 concerns Foxit PDF Reader/Editor components handling AcroForm signatures. The vulnerability is a use-after-free in Signature object processing, arising from not validating the existence of an object before use, which can lead to remote code execution in the process context. Exploit...

CVE-2024-30357

CVE-2024-30357 stems from Foxit PDF Reader/Editor AcroForm Annotation handling where missing validation enables type confusion in Annotations, allowing remote code execution in the target process. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The ...

CVE-2021-34950

CVE-2021-34950 affects Foxit PDF Reader. A flaw in how Annotation objects are validated can cause an out-of-bounds read, enabling arbitrary code execution in the context of the affected process. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file). A...

CVE-2021-34965

CVE-2021-34965 describes a use-after-free in Foxit PDF Editor’s Squiggly Annotation handling. The flaw arises from not validating the existence of an Annotation object before operations, enabling an attacker to execute code in the context of the target process. The vulnerability requires user int...

CVE-2024-30352

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution (CVE-2024-30352) is described as a vulnerability in Foxit PDF Reader where the AcroForm handling can perform operations on objects without validating their existence, enabling code execution via a malicious page or file after user int...

CVE-2024-30363

CVE-2024-30363 affects Foxit PDF Reader (U3D File Parsing) and related Foxit components. The issue is an out-of-bounds read caused by inadequate validation of U3D data during parsing, leading to potential information disclosure and, in combination with other flaws, possible code execution in the ...

CVE-2022-28674

CVE-2022-28674 affects Foxit PDF Reader 11.2.1.53537, where a flaw in the handling of Annotation objects can lead to remote code execution if a user opens a malicious file or visits a malicious page. The underlying issue is the lack of validating an object's existence before performing operations...

CVE-2021-41784

CVE-2021-41784 affects Foxit PDF Reader before 11.1, Foxit PDF Editor before 11.1, and PhantomPDF before 10.1.6. The issue is a use-after-free caused by mishandling of JavaScript, enabling attackers to trigger arbitrary code execution. The vulnerability is listed with LOCAL attack Vector and requ...

CVE-2022-24359

CVE-2022-24359 affects Foxit PDF Reader 11.1.0.52543. The issue arises from not validating the existence of an object before performing operations on it within Doc handling, enabling arbitrary code execution in the current process when a user visits a malicious page or opens a malicious file. The...

CVE-2022-28673

Foxit PDF Reader 11.2.1.53537 is affected by CVE-2022-28673 due to a Doc object handling flaw and missing validation when operating on Doc objects, enabling remote code execution with user interaction (visiting a malicious page or opening a malicious file). Exploitation can run code in the curren...

CVE-2023-38106

CVE-2023-38106 affects Foxit PDF Reader. The vulnerability is an out-of-bounds read in PDF file parsing due to insufficient validation of input, leading to information disclosure. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The issue can be leve...

CVE-2024-30337

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution (CVE-2024-30337) affects Foxit PDF Reader; it stems from not validating the existence of an object before performing operations on AcroForm objects. An attacker can trigger code execution in the target process by convincing a user to ...

CVE-2021-41780

CVE-2021-41780 affects Foxit PDF Reader < 11.1, Foxit PDF Editor < 11.1, and Foxit PhantomPDF

CVE-2024-12751

CVE-2024-12751 affects Foxit PDF Reader, involving an AcroForm out-of-bounds read that can lead to remote code execution. The flaw stems from improper validation of user-supplied data in AcroForms, causing a read past the end of an allocated buffer. An attacker can trigger code execution in the c...

CVE-2026-13128

CVE-2026-13128 affects Foxit PDF Editor/Reader with a use-after-free in the Doc Object when embedding JavaScript in a PDF, leading to application crash and potential remote code execution. The vulnerability impacts the document view’s properties after the page is deleted, enabling continued acces...

CVE-2021-34971

CVE-2021-34971 is a heap-based buffer overflow in Foxit PDF Reader JPG2000 file parsing that enables remote code execution when a user opens a crafted file or visits a malicious page. The root cause is improper validation of the length of user-supplied data before copying it to a heap buffer. The...

CVE-2024-49576

Foxit Reader 2024.3.0.26795 contains a use-after-free in handling the checkbox CBF_Widget object. A crafted PDF with JavaScript can trigger memory corruption and arbitrary code execution. Exploitation requires user interaction (opening the malicious file or visiting a malicious site if the browse...

CVE-2022-34873

CVE-2022-34873 affects Foxit PDF Reader 11.2.1.53537 (and is referenced in multiple advisories) where JavaScript actions on Annotation objects can trigger a read past the end of an allocated object, enabling sensitive data disclosure and, in conjunction with other flaws, arbitrary code execution ...

CVE-2022-34875

CVE-2022-34875 affects Foxit PDF Reader 11.2.1.53537. The flaw is in handling ADBC objects; by actions in JavaScript, an attacker can trigger a read past the end of an allocated object, potentially disclosing sensitive information and enabling arbitrary code execution in the context of the proces...

CVE-2026-3775

CVE-2026-3775 affects Foxit PDF Editor/Reader (update service) and is due to the update check loading system libraries from a path that includes user-writable directories, not restricted to trusted system locations. This allows a local attacker with low privileges to place a malicious library tha...

CVE-2021-34952

Summary: CVE-2021-34952 is a Foxit PDF Reader Use-After-Free remote code execution flaw in the Annotation handling path. The issue arises from not validating the existence of an Annotation object before operations, enabling code execution in the affected process when a user opens a malicious page...

CVE-2021-34957

Summary: CVE-2021-34957 affects Foxit PDF Editor/Reader. The flaw is a Use-After-Free in the handling of Annotation objects, caused by not validating the existence of an object before performing operations on it. This can allow remote code execution in the context of the affected process when a u...

CVE-2021-34958

Foxit PDF Editor (Text Annotation) contains a use-after-free vulnerability (CVE-2021-34958) in the handling of Annotation objects that allows remote code execution. The flaw arises from not validating the existence of an object before performing operations, enabling code execution in the context ...

CVE-2021-34974

CVE-2021-34974 affects Foxit PDF Reader/Annotation handling where Use-After-Free occurs due to not validating object existence before operations. This leads to remote code execution in the context of the current process, requiring user interaction (visit malicious page or open a malicious file). ...

CVE-2023-38117

CVE-2023-38117 affects Foxit PDF Reader (AcroForm Doc Object) and is a Use-After-Free in handling Doc objects, caused by not validating object existence before operations. This can allow remote code execution with the attacker hosting a malicious page or file, requiring user interaction. The vuln...

CVE-2024-30325

CVE-2024-30325 describes a use-after-free vulnerability in Foxit PDF Reader related to AcroForms. The flaw occurs when handling Doc objects in AcroForms: the code does not validate the existence of an object before performing operations, enabling an attacker to execute arbitrary code in the conte...

CVE-2024-30335

CVE-2024-30335 affects Foxit PDF Reader (AcroForm) and related Foxit PDF Editor components. The flaw is in AcroForm Annotation handling where user-supplied data is not properly validated, causing an out-of-bounds read that can disclose sensitive information. Access requires user interaction (open...

CVE-2022-28680

CVE-2022-28680 affects Foxit PDF Reader 11.2.1.53537 where the bug lies in handling of Annotation objects, failing to validate object existence before operations. This allows remote code execution in the context of the current process and requires user interaction (visiting a malicious page or op...

CVE-2024-30351

CVE-2024-30351 concerns Foxit PDF Reader/Editor and relates to Use-After-Free vulnerabilities in AcroForms and Doc objects that can lead to remote code execution. The flaw stems from not validating object existence before performing operations on Doc objects and within AcroForm handling, allowing...

CVE-2023-38107

CVE-2023-38107 is a Foxit PDF Reader/Editor vulnerability in the handling of Annotation objects. The flaw stems from not validating the existence of an object before performing operations, allowing an attacker to achieve remote code execution in the context of the current process. Exploitation re...

CVE-2021-34951

CVE-2021-34951 is a vulnerability in Foxit PDF Reader (and related components) where an uninitialized pointer in the handling of Annotation objects can disclose sensitive information. The flaw can allow a remote attacker to access information from the current process by convincing a user to view ...

CVE-2021-34972

CVE-2021-34972 affects Foxit PDF Reader (AcroForms processing). The flaw arises from not validating the existence of an AcroForm object before operations, enabling information disclosure and, with other flaws, potential arbitrary code execution in the target process. User interaction is required ...

CVE-2023-38113

CVE-2023-38113 affects Foxit PDF Reader/Editor (Annotation handling).根The flaw is Use-After-Free in Annotation objects due to missing validation of object existence, enabling information disclosure and potential arbitrary code execution when paired with other vulnerabilities. Exploitation require...

CVE-2023-38116

CVE-2023-38116 concerns Foxit PDF Reader: a Doc Object Out-of-Bounds Read that can disclose sensitive information and, with additional vulnerabilities, may enable arbitrary code execution. The flaw stems from improper validation of user-supplied data during Doc object handling, allowing reads pas...

CVE-2024-30326

CVE-2024-30326 concerns Foxit PDF Reader/Controller components (Foxit PDF Reader) where the Doc Object Use-After-Free vulnerability exists in the handling of Doc objects. The flaw stems from not validating the existence of an object before performing operations, enabling an attacker to execute co...

CVE-2024-30364

CVE-2024-30364 pertains to Foxit PDF Reader’s U3D File Parsing causing an Out-of-Bounds Read Information Disclosure. Affected component: U3D file parsing; root cause: insufficient validation of user-supplied data leading to a read past the end of an allocated buffer. Impact: potential information...

CVE-2021-34949

CVE-2021-34949 affects Foxit PDF Reader (and related Foxit products) with an Annotation object handling flaw that allows out-of-bounds reads and information disclosure. The root cause is improper validation of user-supplied data in Annotation objects, which can read past the end of an allocated o...

CVE-2021-40326

CVE-2021-40326 affects Foxit PDF Reader before 11.1, Foxit PDF Editor before 11.1, and Foxit PhantomPDF before 10.1.6. The flaw stems from mishandling hidden and incremental data in digitally signed PDFs, enabling an attacker to write to an arbitrary file and display controlled contents during si...

CVE-2021-41781

CVE-2021-41781 affects Foxit PDF Reader < 11.1, Foxit PDF Editor < 11.1, and PhantomPDF

CVE-2023-38112

CVE-2023-38112 affects Foxit PDF Reader (XFA Annotation) with a use-after-free in the handling of Annotation objects. The flaw arises from not validating the existence of an object before performing operations, enabling an attacker to execute arbitrary code in the current process. Impact is high ...

CVE-2024-30361

CVE-2024-30361 is a Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution vulnerability. Root cause: object existence is not validated before operations on AcroForm objects, allowing code execution in the app process. Exploitation requires user interaction (visiting malicious page or ope...

CVE-2021-34970

CVE-2021-34970 (Foxit PDF Reader / PhantomPDF) is a vulnerability where the print method mishandles a user-supplied string used as a format specifier, due to improper validation. This leads to information disclosure on affected Foxit PDF Reader/PhantomPDF installations and, per sources, can be le...

CVE-2023-38115

Summary: CVE-2023-38115 affects Foxit PDF Reader/Editor related to AcroForm handling. The root cause is improper validation of user-supplied data in Doc Objects, causing an out-of-bounds read that may disclose memory content. The vulnerability is described as enabling information disclosure, with...

CVE-2024-32488

CVE-2024-32488 describes a local privilege escalation in Foxit PDF Reader and Editor prior to 2024.1. The root cause is weak permissions on the update-service folder, which could allow an attacker to drop crafted DLLs during update checks and gain higher privileges. Affected component: update mec...

CVE-2021-34955

Foxit PDF Editor Stamp Annotation Use-After-Free (CVE-2021-34955) is documented as a remote code execution vulnerability caused by a missing validation of an Annotation object before operations. The flaw allows an attacker to run arbitrary code in the target process when a user visits a malicious...

CVE-2021-34963

CVE-2021-34963 affects Foxit PDF software (PDF Editor/Reader) where the PolyLine Annotation is handled insecurely, leading to a Use-After-Free that can allow remote code execution. The flaw stems from not validating the existence of an object before performing operations on Annotation objects, en...