CVE-2021-34968

CVE-2021-34968 concerns Foxit PDF Editor. The flaw lies in the transitionToState implementation where the code does not validate the existence of an object before operating on it, enabling a Use-After-Free that can lead to Remote Code Execution . Exploitation requires user interaction (the target...

CVE-2023-38118

CVE-2023-38118 affects Foxit PDF Reader (AcroForm Doc object) with an out-of-bounds write that enables remote code execution. The flaw arises from insufficient validation when handling Doc objects, allowing write past the end of an allocated object. Exploitation requires user interaction (visitin...

CVE-2024-30342

CVE-2024-30342 affects Foxit PDF Reader/Editor. The vulnerability is a Use-After-Free in handling of Annotation objects, caused by not validating the existence of an object before operations, enabling code execution in the process context when a user opens a malicious file or visits a crafted pag...

CVE-2024-30343

CVE-2024-30343 is a Foxit PDF Reader Annotation Use-After-Free Remote Code Execution. The flaw arises from not validating the existence of an object before performing operations on Annotation objects, enabling code execution in the current process when a user opens a malicious file/page or visits...

CVE-2024-30355

Foxit PDF Reader exposes an AcroForm Out-Of-Bounds Write Remote Code Execution vulnerability (CVE-2024-30355) in the Doc objects handling. Root cause: insufficient validation of user-supplied data, leading to write past end of allocated buffer; attacker could execute code in the target process. E...

CVE-2021-34948

CVE-2021-34948 is a Foxit PDF Reader vulnerability (Square Annotation Use-After-Free) that allows remote code execution. The flaw arises from not validating the existence of a square annotation object before performing operations, enabling an attacker to execute code in the process context. Explo...

CVE-2021-34959

CVE-2021-34959 affects Foxit PDF Editor, with a vulnerability in the handling of Square/Annotation objects. The issue is described as a use-after-free flaw caused by not validating the existence of an object before operations, enabling an attacker to execute arbitrary code in the process context....

CVE-2022-24908

CVE-2022-24908 affects Foxit PDF Reader 11.1.0.52543. The flaw is in parsing JP2 images, where crafted data can trigger a read past the end of an allocated buffer, allowing remote code execution in the context of the current process. Exploitation requires user interaction (visiting a malicious pa...

CVE-2023-27329

CVE-2023-27329 affects Foxit PDF Reader. The vulnerability is a Use-After-Free in Annotation handling caused by not validating object existence before operations, enabling arbitrary code execution in the process context. Exploitation requires user interaction (target visits a malicious page or op...

CVE-2024-30349

CVE-2024-30349 describes a remote code execution in Foxit PDF Reader via U3D file parsing. The flaw arises from inadequate validation of user-supplied data during U3D parsing, causing an out-of-bounds write that can execute code in the target process. Exploitation requires user interaction (visit...

CVE-2021-34954

CVE-2021-34954 affects Foxit PDF Editor. The flaw is in how Annotation objects are handled, failing to validate the existence of an object before operating on it, leading to a Use-After-Free that can allow code execution in the current process. The description states that attackers can trigger th...

CVE-2022-28683

Foxit PDF Reader 11.2.1.53537 is affected by a remote code execution vulnerability in the deletePages path where the code fails to validate object existence before operating on it. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The issue can allow ...

CVE-2024-25938

CVE-2024-25938 affects Foxit Reader 2024.1.0.23997 and is a use-after-free vulnerability in the Barcode widget. According to Talos, a specially crafted JavaScript in a malicious PDF can trigger reuse of a freed object, leading to memory corruption and potentially arbitrary code execution. Exploit...

CVE-2024-9251

CVE-2024-9251 corresponds to a Foxit PDF Reader/Editor use-after-free vulnerability affecting annotation handling (and related Doc/AcroForm objects) that can lead to information disclosure and, in conjunction with other flaws, arbitrary code execution. The root cause cited is lack of validation f...

CVE-2021-34973

CVE-2021-34973 : Foxit PDF Reader contains a information-disclosure use-after-free vulnerability in PDF parsing. The flaw arises from not validating the existence of an object before performing operations, enabling an attacker to disclose sensitive information on affected installations. Exploitat...

CVE-2023-27330

CVE-2023-27330 describes a remote code execution flaw in Foxit PDF Reader tied to the handling of XFA annotations. The root cause is the lack of validating the existence of an Annotation object before performing operations, enabling an attacker to run code in the process context after a user open...

CVE-2023-27364

Foxit PDF Editor is affected by CVE-2023-27364: a remote code execution vulnerability in XLS file parsing due to insufficient restrictions on macro-enabled documents. An attacker can entice a user to open a malicious XLS or visit a malicious page, causing code execution in the target process. Use...

CVE-2023-38114

CVE-2023-38114 is a Foxit PDF Reader/Editor vulnerability described as an AcroForm Doc Object Use-After-Free leading to remote code execution. The flaw stems from not validating the existence of a Doc object before performing operations, allowing an attacker to run code in the user’s context afte...

CVE-2023-38119

Foxit PDF Reader is affected by an AcroForm signature handling vulnerability (CVE-2023-38119): an out-of-bounds read caused by insufficient validation of user-supplied data in signature fields can lead to remote code execution. Exploitation requires user interaction (visiting a malicious page or ...

CVE-2024-30334

Foxit PDF Reader (and related Foxit PDF Editor versions) contains a Doc Object Use-After-Free Remote Code Execution vulnerability. The flaw arises from not validating the existence of an object before performing operations on Doc objects, allowing an attacker to execute code in the context of the...

CVE-2024-30347

Foxit PDF Reader CVE-2024-30347 describes an information-disclosure vulnerability in the U3D file parsing path. The flaw stems from insufficient validation of user-supplied data, allowing a read past the end of an allocated object and potentially exposing sensitive information. Exploitation requi...

CVE-2021-34961

Foxit PDF Editor/Reader (incl. PhantomPDF lineage) is affected by a Use-After-Free in the Ink Annotation handling. The flaw arises from not validating the existence of an Annotation object before performing operations, allowing an attacker to execute code in the victim process. Exploitation requi...

CVE-2022-28104

Foxit PDF Editor 11.3.1 is affected by an arbitrary file upload vulnerability. Based on CVE-2022-28104 details, the issue has a high to critical impact (CVSS 3.1: 9.8) with network access, no authentication, and full confidentiality, integrity, and availability impact as reported. The available d...

CVE-2023-38110

The CVE-2023-38110 entry covers Foxit PDF Reader: an out-of-bounds read in AcroForm Doc objects due to insufficient validation of user-supplied data. This can disclose sensitive information and, in combination with other vulnerabilities, could enable arbitrary code execution in the target process...

CVE-2021-34964

Foxit PDF Editor exposes a Use-After-Free vulnerability in Polygon Annotation handling (Annotation objects). The flaw stems from not validating the existence of an object before operations, allowing attacker-controlled input to run arbitrary code with the user’s privileges when a target visits a ...

CVE-2022-28677

CVE-2022-28677 affects Foxit PDF Reader 11.2.1.53537. The flaw lies in how Annotation objects are handled: the code fails to validate the existence of an object before operating on it, enabling remote code execution when a user opens a malicious page or file and interacts with it. The vulnerabili...

CVE-2022-37386

CVE-2022-37386 affects Foxit PDF Reader 11.2.2.53575. The issue is in the resetForm method, where JavaScript actions can trigger a read past the end of an allocated object. This can be leveraged with other vulnerabilities to execute arbitrary code in the target process, with user interaction requ...

CVE-2022-43638

CVE-2022-43638 affects Foxit PDF Reader 12.0.1.12430. The flaw is in U3D file parsing, arising from not validating the existence of an object before performing operations, which can allow a remote attacker to execute arbitrary code. Exploitation requires user interaction (target must visit a mali...

CVE-2024-30323

CVE-2024-30323 : Foxit PDF Reader template out-of-bounds read leading to remote code execution. The flaw arises from improper validation of user-supplied data in template objects, causing a read past the end of an allocated object and enabling code execution in the attacker’s context. Exploitatio...

CVE-2021-34953

CVE-2021-34953 affects Foxit PDF Reader. The vulnerability is in the handling of Annotation objects and arises from the lack of proper initialization of a pointer before access, enabling remote code execution. attacker-controlled input on a malicious page or file can execute code in the context o...

CVE-2021-34960

Foxit PDF Editor CVE-2021-34960: Use-after-free in Circle Annotation handling allows remote code execution when a user visits a malicious page or opens a malicious file. Root cause: missing validation of object existence before operations on Annotation objects, executing code in the current proce...

CVE-2022-28675

Foxit PDF Reader 11.2.1.53537 is affected by CVE-2022-28675, a vulnerability in handling Annotation objects that allows remote code execution after user visits a malicious page/file. The flaw stems from not validating object existence before operations, enabling code execution in the current proc...

CVE-2023-38111

CVE-2023-38111 affects Foxit PDF Reader/Editor where the fault lies in how annotation objects are handled. The vulnerability is a use-after-free caused by not validating the existence of an object before performing operations on it, enabling code execution in the context of the current process. I...

CVE-2023-51561

CVE-2023-51561 affects Foxit PDF Reader via the PDF file parsing path. The flaw is an out-of-bounds read caused by insufficient validation of input data, leading to information disclosure and, per the description, potential arbitrary code execution in conjunction with other vulnerabilities. Affec...

CVE-2024-30340

CVE-2024-30340 describes a Foxit PDF Reader annotation handling vulnerability where inadequate validation of user-supplied data in Annotation objects can cause an out-of-bounds read, leading to information disclosure. The flaw allows remote disclosure of sensitive data when a user visits a malici...

CVE-2024-30366

Foxit PDF Reader/Editor is affected by an AcroForm Use-After-Free remote code execution (CVE-2024-30366). The flaw arises from not validating object existence before operating on it, enabling code execution in the current process when a user opens a malicious file/page. Exploitation requires user...

CVE-2021-34956

CVE-2021-34956 is a use-after-free vulnerability in Foxit PDF Editor related to Annotation object handling (Underline Annotation). The flaw stems from not validating an object's existence before operations, enabling potential code execution in the application's context. It requires user interacti...

CVE-2021-34966

Foxit PDF Editor - CVE-2021-34966: A use-after-free in FileAttachment Annotation handling arises from not validating the existence of an object before operations, enabling remote code execution. Affected: Foxit PDF Editor (annotation processing path). Impact: arbitrary code execution in the conte...

CVE-2021-34976

Summary of CVE-2021-34976 (Foxit PDF Reader) : The vulnerability is a Use-After-Free information disclosure in Foxit PDF Reader’s PDF parsing. The flaw stems from the program’s handling of PDF objects, specifically the failure to validate the existence of an object before performing operations on...

CVE-2022-28669

CVE-2022-28669 affects Foxit PDF Reader 11.2.1.53537. The flaw lies in handling of Doc objects where the existence of an object is not validated before operations, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a malicious page or opening a...

CVE-2022-28678

CVE-2022-28678 affects Foxit PDF Reader 11.2.1.53537. The flaw is in the handling of Doc objects, where the code does not validate the existence of an object before performing operations, enabling arbitrary code execution in the context of the current process. Exploitation requires user interacti...

CVE-2024-12752

Foxit PDF Reader CVE-2024-12752 is a memory-corruption flaw in AcroForms that allows remote code execution when a user opens a malicious file or visits a crafted page. Impact is RCE in the context of the Foxit Reader process, with user interaction required (no exploit specifics provided in the in...

CVE-2024-30330

CVE-2024-30330 is a Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution vulnerability. The flaw arises from not validating the existence of an object before performing operations on Doc objects within AcroForms, allowing an attacker to execute code in the current process. Exploitation ...

CVE-2024-30338

CVE-2024-30338 is a Foxit PDF Reader Use-After-Free vulnerability in the handling of Doc objects. The flaw stems from not validating the existence of a Doc object before performing operations, enabling an attacker to execute code in the current process. Exploitation requires user interaction (e.g...

CVE-2024-30344

CVE-2024-30344 affects Foxit PDF Reader (and related Foxit PDF Editor/Reader variants). The flaw is an AcroForm Use-After-Free Remote Code Execution due to not validating the existence of an object before performing operations, allowing code execution in the process context. Exploitation requires...

CVE-2024-30346

Summary: CVE-2024-30346 affects Foxit PDF Reader/Editor components handling AcroForms and Doc objects, leading to a Use-After-Free remote code execution. The flaw arises from not validating the existence of target objects before operations, enabling an attacker to run code in the target process a...

CVE-2021-34975

CVE-2021-34975 : Foxit PDF Reader contains a use-after-free in the transitionToState method, caused by failing to validate an object’s existence before use. This allows an attacker to execute arbitrary code in the context of the current process, with user interaction required (target must visit a...

CVE-2022-37385

CVE-2022-37385 (Foxit PDF Reader version 11.2.1.53537) is a renderer/process‑level vulnerability originating from the handling of Doc objects where the code fails to validate the existence of an object before performing operations. This allows remote attackers to execute arbitrary code in the con...

CVE-2023-27366

CVE-2023-27366 affects Foxit PDF Reader. It is a Doc object handling Use-After-Free vulnerability that allows an attacker to execute code in the context of the current process. Exploitation requires user interaction (target visits a malicious page or opens a malicious file). The vulnerability is ...

CVE-2024-12753

CVE-2024-12753 concerns Foxit PDF Reader. Connected sources confirm a local privilege escalation via the installer: by creating a junction, an attacker can abuse the installer process to create an arbitrary file and escalate privileges to SYSTEM after gaining low-privilege code execution. Impact ...