CVE-2024-12753

CVE-2024-12753 concerns Foxit PDF Reader. Connected sources confirm a local privilege escalation via the installer: by creating a junction, an attacker can abuse the installer process to create an arbitrary file and escalate privileges to SYSTEM after gaining low-privilege code execution. Impact ...

CVE-2024-30327

CVE-2024-30327 affects Foxit PDF Reader (and by extension Foxit PDF Editor) with a Use-After-Free in template objects during processing of template documents. The flaw stems from not validating object existence before operations, enabling arbitrary code execution in the current process when a use...

CVE-2024-30328

Foxit PDF Reader/Editor (various Mac/Windows versions) is affected by CVE-2024-30328: an Use-After-Free in AcroForms Doc objects leading to remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a crafted file). The issue stems from not validating obje...

CVE-2024-30354

CVE-2024-30354 affects Foxit PDF Reader (AcroForm) with a Use-After-Free in AcroForms handling of Doc objects, caused by not validating object existence before operations. The vulnerability allows code execution in the process context and requires user interaction (target must visit a malicious p...

CVE-2024-9249

CVE-2024-9249 affects Foxit PDF Reader. It is a PDF parsing out-of-bounds read that can lead to remote code execution. The flaw arises during PDF data parsing due to insufficient validation, enabling an attacker to execute code in the process when a victim opens a crafted file or visits a malicio...

CVE-2026-3774

Foxit PDF Editor/Reader (pre-2026.1) is affected by CVE-2026-3774 due to PDF JavaScript and document/print actions (WillPrint/DidPrint) updating form fields, annotations, or OCGs around redaction, encryption, or printing. The script-driven updates are not fully covered by the existing redaction/e...

CVE-2023-27331

CVE-2023-27331 affects Foxit PDF Reader (annotation handling). The vulnerability is a Use-After-Free in the processing of Annotation objects that can allow remote code execution in the context of the current process. Exploitation requires user interaction (visiting a malicious page or opening a m...

CVE-2023-38109

CVE-2023-38109 concerns Foxit PDF Reader. The issue occurs in the handling of Doc objects and stems from insufficient validation of user-supplied data, causing an out-of-bounds read (read past end of a buffer). The vulnerability can lead to disclosure of sensitive information on affected installa...

CVE-2024-25648

Foxit Reader 2024.1.0.23997 is affected by a use-after-free in the ComboBox handling that can be triggered when processing JavaScript in a malicious PDF or when visiting a crafted site with the browser plugin enabled. Talos provides concrete details on the vulnerable path: a ComboBox object is fr...

CVE-2024-30353

CVE-2024-30353 is a Foxit PDF Reader AcroForm Use-After-Free/Out-of-Bounds Read vulnerability with the root cause in AcroForm Doc object handling. The issue allows an attacker to trigger a read past the end of a buffer, potentially enabling remote code execution in the context of the current proc...

CVE-2023-27365

CVE-2023-27365 affects Foxit PDF Editor (and related Foxit PhantomPDF components) via a flaw in DOC file parsing where macro-enabled documents are not properly restricted. An attacker can trigger arbitrary code execution by convincing a user to open a malicious DOC/file or visit a malicious page,...

CVE-2024-30359

CVE-2024-30359 describes a remote code execution vulnerability in Foxit PDF Reader related to AcroForm 3D objects. The flaw arises from insufficient validation of user-supplied data when handling 3D AcroForm objects, allowing an out-of-bounds read that can lead to code execution in the context of...

CVE-2021-34967

CVE-2021-34967 affects Foxit PDF Editor (Line Annotation) and is a use-after-free in handling annotation objects. The flaw stems from not validating the existence of an Annotation object before operations, enabling remote code execution when a user opens a malicious page/file or visits a maliciou...

CVE-2022-24907

CVE-2022-24907 affects Foxit PDF Reader 11.1.0.52543. The flaw lies in JP2 image parsing, where crafted JP2 data can trigger a read past the end of an allocated buffer, allowing remote code execution in the context of the current process. User interaction is required (visiting a malicious page or...

CVE-2023-38105

CVE-2023-38105 is a Foxit PDF Reader parsing vulnerability (Out-of-Bounds Read) that allows disclosure of sensitive information through PDF parsing without proper validation. The flaw occurs when handling PDF data, potentially reading past the end of an allocated object. Exploitation is described...

CVE-2023-42091

CVE-2023-42091 is a Foxit PDF Reader/XFA vulnerability where the program mishandles Doc objects, failing to validate an object exists before operations, causing a use-after-free that can lead to remote code execution. The issue affects Foxit PDF Reader (and variants like Foxit PhantomPDF) and req...

CVE-2023-42098

CVE-2023-42098 : Foxit PDF Reader/Editor products are affected by a Use-After-Free in the handling of Annotation objects, caused by not validating the existence of an object before performing operations. This can lead to an information disclosure vulnerability and, in conjunction with other issue...

CVE-2023-51552

CVE-2023-51552 affects Foxit PDF Reader/Editor (AcroForm Signature) and is a Use-After-Free in how Signature objects are handled. The flaw stems from not validating object existence before operations, enabling code execution in the process context when a user opens a malicious file or visits a ma...

CVE-2024-30333

CVE-2024-30333 is a Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution vulnerability. The flaw arises from not validating the existence of a Doc object before performing operations, enabling an attacker to execute code in the process context. Exploitation requires user interaction (...

CVE-2024-30341

CVE-2024-30341 – Foxit PDF Reader Doc Object Out-Of-Bounds Read RCE . Affected product: Foxit PDF Reader. Root cause: improper validation of user-supplied data in Doc object handling leads to a read past end of an allocated buffer, enabling remote code execution in the context of the target proce...

CVE-2024-30348

CVE-2024-30348 affects Foxit PDF Reader (and related Foxit PDF tooling) with an out-of-bounds write during U3D file parsing that can lead to remote code execution. The flaw stems from improper validation of user-supplied data in the U3D parsing path, allowing an attacker to write past the end of ...

CVE-2022-37388

CVE-2022-37388 affects Foxit PDF Reader 11.2.2.53575. The flaw is in PDF parsing where crafted data can trigger a read past the end of an allocated buffer, allowing remote code execution in the context of the current process. User interaction is required (visiting a malicious page or opening a ma...

CVE-2023-51558

CVE-2023-51558 refers to a Foxit PDF Reader AcroForm Doc out-of-bounds read information disclosure. The flaw arises from improper validation of Doc object data, allowing a read past the end of an allocated buffer. This could enable sensitive information disclosure and, in conjunction with other v...

CVE-2024-30360

CVE-2024-30360 affects Foxit PDF Reader (AcroForm handling). Root cause: Use-After-Free due to not validating object existence before operations, enabling remote code execution when a user opens a malicious file/page. Exploitation requires user interaction; exploitability is indicated as high imp...

CVE-2022-43641

CVE-2022-43641 affects Foxit PDF Reader 12.0.1.12430. The issue arises in parsing U3D files due to not validating an object's existence before operations, enabling information disclosure and, with other vulnerabilities, potential arbitrary code execution in the target process. Exploitation requir...

CVE-2024-30324

Foxit PDF Reader/Editor is affected by a Doc Object Use-After-Free Remote Code Execution vulnerability. The flaw arises from not validating the existence of a Doc object before performing operations, allowing an attacker to execute code in the current process when a user opens a malicious file or...

CVE-2021-34969

CVE-2021-34969 affects Foxit Reader (Annotation objects) where missing validation of an Annotation object can lead to information disclosure and, in conjunction with other vulnerabilities, arbitrary code execution. The NVD description notes that user interaction is required (target must visit a m...

CVE-2022-34874

CVE-2022-34874 affects Foxit PDF Reader 11.2.2.53575. The flaw is in the handling of Doc objects, where JavaScript actions can trigger a read past the end of an allocated object, potentially enabling arbitrary code execution in the context of the current process when a user opens a malicious page...

CVE-2022-37380

Foxit PDF Reader 11.2.1.53537 is affected by a vulnerability in the handling of ADBC objects that can be triggered by JavaScript actions, allowing read past the end of an allocated object. An attacker could leverage this with other vulnerabilities to execute arbitrary code in the context of the c...

CVE-2023-51550

CVE-2023-51550 affects Foxit PDF Reader/Editor. The issue lies in how combobox fields are handled, due to insufficient validation of user data, which can cause an out-of-bounds read and information disclosure. The description notes that this could be leveraged (in conjunction with other vulnerabi...

CVE-2023-51557

CVE-2023-51557 affects Foxit PDF Reader/Editor (AcroForm Doc handling). The flaw is a Use-After-Free in Doc objects due to not validating the existence of an object before operations, allowing code execution in the current process. Exploitation requires user interaction (visiting a malicious page...

CVE-2023-51562

Technical details for CVE-2023-51562 are not publicly provided in the supplied documents. Monitor for updates from vendors and security bulletins.

CVE-2024-29072

The CVE refers to a privilege-escalation flaw in Foxit Reader 2024.2.0.25138 caused by improper certification validation of the updater executable before it runs. The issue allows a low-privilege user to trigger an update action, potentially elevating privileges (local access, user interaction re...

CVE-2024-30322

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution (CVE-2024-30322) affects Foxit PDF Reader/Editor; the issue stems from not validating the existence of an object before performing operations on AcroForm objects, enabling code execution in the current process when a user opens a mali...

CVE-2024-7722

CVE-2024-7722 is associated with Foxit PDF Reader/Editor and involves a Use-After-Free in the handling of Doc objects that can disclose information and, when combined with other vulnerabilities, may enable code execution in the impacted process. The vulnerability requires user interaction (visiti...

CVE-2024-30329

CVE-2024-30329 concerns Foxit PDF Reader/Viewer: an Annotation Use-After-Free vulnerability in the handling of Annotation objects. The flaw arises from not validating object existence before performing operations, enabling an information disclosure exposure on affected installations. The descript...

CVE-2024-30336

CVE-2024-30336 is a Foxit PDF Reader/Editor vulnerability rooted in the AcroForm Doc object handling. The flaw is a use-after-free in AcroForms where the code fails to validate object existence before operations, enabling arbitrary code execution in the process context when a user opens a malicio...

CVE-2024-30350

CVE-2024-30350 concerns Foxit PDF Reader: an out-of-bounds read in the Annotation handling can disclose sensitive information. The flaw stems from inadequate validation of user-supplied data, risking a read past the end of an allocated buffer. An attacker can exploit this on affected installation...

CVE-2022-37387

CVE-2022-37387 affects Foxit PDF Reader 11.2.2.53575. The Red Hat and NVD entries confirm the flaw is in AcroForms handling, arising from not validating the existence of an object before performing operations. This can allow code execution in the context of the current process when a user visits ...

CVE-2022-37389

CVE-2022-37389 affects Foxit PDF Reader (11.2.2.53575). The root cause is improper handling in AcroForms due to not validating object existence before operations, enabling remote code execution when a user visits a malicious page or opens a malicious file. The vulnerability requires user interact...

CVE-2024-30332

Foxit PDF Reader is affected by a Doc Object Use-After-Free Remote Code Execution vulnerability (CVE-2024-30332). The flaw stems from not validating the existence of a Doc object before performing operations, enabling code execution in the context of the current process. The issue requires user i...

CVE-2024-30356

Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure vulnerability (CVE-2024-30356) affects Foxit PDF Reader. The issue lies in AcroForm Doc object handling where user-supplied data isn’t properly validated, permitting a read past the end of an allocated buffer and potential inform...

CVE-2024-7723

CVE-2024-7723 is a Foxit PDF Reader/Editor use-after-free vulnerability in AcroForm handling that allows remote code execution after a user opens a malicious PDF or visits a malicious page. The flaw stems from validating the existence of an object before operations, enabling code execution in the...

CVE-2024-7724

Summary: CVE-2024-7724 is a Foxit PDF Reader/Editor use-after-free vulnerability in AcroForm handling that can lead to remote code execution. The exploit requires user interaction (the target must open a malicious file or visit a malicious page). Affects: Foxit PDF Reader/Editor (various versions...

CVE-2022-37376

CVE-2022-37376 affects Foxit PDF Editor 11.1.1.53537. The flaw lies in the handling of arrays, where actions in JavaScript can trigger a read past the end of an allocated object, enabling sensitive information disclosure. User interaction is required (target must visit a malicious page or open a ...

CVE-2022-43640

The vulnerability CVE-2022-43640 affects Foxit PDF Reader 12.0.1.12430. The flaw is in PDF parsing: crafted data in a PDF can trigger a read past the end of an allocated buffer. This may allow information disclosure and, in conjunction with other issues, could enable arbitrary code execution in t...

CVE-2023-51549

CVE-2023-51549 pertains to Foxit PDF Reader/Editor and is described as a Use-After-Free vulnerability in the AcroForm Doc Object handling. The flaw arises from failing to validate the existence of an object before performing operations, enabling an attacker to execute code in the context of the v...

CVE-2023-51560

CVE-2023-51560 is a Foxit PDF Reader/Editor vulnerability where the handling of Annotation objects allows a type confusion that can lead to arbitrary code execution. The flaw stems from insufficient validation of user-supplied data within Annotations, enabling an attacker to execute code in the c...

CVE-2024-30339

CVE-2024-30339 describes a remote code execution in Foxit PDF Reader caused by an AcroForm Use-After-Free flaw. The vulnerability stems from not validating the existence of an object before performing operations on AcroForm-related objects, enabling an attacker to execute code in the target proce...

CVE-2022-37381

CVE-2022-37381 affects Foxit PDF Reader. The flaw is in the AFSpecial_KeystrokeEx method, arising from not validating the existence of an object before performing operations, which allows an attacker to execute code in the context of the current process. Exploitation requires user interaction (th...