CVE-2024-25575
high · 8.8A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
8.8
CVSS
17.7%
EPSS (exploit prob.)
97th
EPSS percentile
2024-04-30
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-843
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| foxit | pdf_editor | <= 11.2.8.53842 |
| foxit | pdf_editor | >= 12.0.0.12394, <= 12.1.4.15400 |
| foxit | pdf_editor | >= 13.0.0.21632, <= 13.0.1.21693 |
| foxit | pdf_editor | >= 2023.1.0.15510, <= 2023.3.0.23028 |
| foxit | pdf_editor | 2024.1.0.23997 |
| foxit | pdf_reader | 2024.1.0.23997 |
| microsoft | windows | all versions |
| foxit | pdf_editor | <= 11.1.6.0109 |
| foxit | pdf_editor | >= 12.0.0.0601, <= 12.1.2.55366 |
| foxit | pdf_editor | >= 13.0.0.61829, <= 13.0.1.61866 |
| apple | macos | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2024-25575