Missing JavaScript Authorization in Foxit PDF Editor/Reader Exposes Other Open PDFs
AI analysis
Foxit PDF Editor and Foxit PDF Reader fail to enforce the attribute-level authorization checks required by the PDF JavaScript specification, in the area of the activeDocs interface. When a victim opens a malicious PDF that is treated as trusted, its embedded JavaScript can read sensitive content from other documents open in the same process and transmit that data to an external party. The impact is confidentiality-only (high confidentiality impact, no integrity or availability impact), and exploitation requires user interaction with high attack complexity, limiting its practical severity to medium (CVSS 4.7). Anyone running an unpatched Foxit PDF Editor or Reader on Windows or other supported desktop platforms is affected. There is no known public proof of concept, and the flaw is not on the CISA Known Exploited Vulnerabilities list.
What to do: Upgrade Foxit PDF Editor and Reader to the latest release that remediates ZDI-26-720 (confirm the exact fixed build in Foxit's security advisory, since affected ranges were not listed here). As a defense-in-depth measure, disable or restrict JavaScript execution in Foxit's preferences so untrusted documents cannot script the activeDocs interface, and remind users to open PDFs only from known sources. Watch for unusual outbound network traffic from the PDF application, which could indicate attempted exfiltration.
Affected
| Foxit PDF Editor | — |
| Foxit PDF Reader | — |
Estimated exposure
masslikely tens of millions of desktop installations worldwide — Foxit PDF Reader is a widely distributed free desktop PDF client and the vendor has historically claimed user bases in the hundreds of millions, so even a conservative fraction of active installs is in the tens of millions; exposure is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.