Foxit PDF Reader AcroForm use after free

Summaryinfo

A vulnerability identified as problematic has been detected in Foxit PDF Reader. Affected is an unknown function of the component AcroForm. The manipulation leads to use after free. This vulnerability is documented as CVE-2024-9252. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Foxit PDF Reader (affected version not known). This issue affects some unknown functionality of the component AcroForm. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality. The summary by CVE is:

Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24491.

It is possible to read the advisory at zerodayinitiative.com. The identification of this vulnerability is CVE-2024-9252 since 09/26/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 207793 (Foxit PDF Editor < 13.1.4 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (207793). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Document Reader Software

Vendor

• Foxit

Name

• PDF Reader

License

• free

Website

• Vendor: https://www.foxitsoftware.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion