AI analysis
Foxit PDF Editor and Reader contain a use-after-free flaw (CWE-416) that is triggered when the application processes a specially crafted PDF file. Malicious JavaScript inside the PDF causes a reentrant execution condition through page-visibility events, leading the app to access an already-freed page-view object while calculating annotation boundaries, producing an invalid memory read and a crash. Exploitation requires the victim to open a malicious PDF, so the flaw spreads primarily through phishing, malicious downloads, or booby-trapped documents. The described impact is at minimum an application crash (denial of service); the CVSS 3.1 vector also rates high confidentiality and integrity impact, which typically implies potential code execution, though only the memory-read/crash behavior is documented. There is no known public proof of concept and the issue is not in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been observed.
What to do: Update Foxit PDF Editor/Reader to the latest release and consult Foxit's security bulletin for the exact fixed build, since affected version ranges are not enumerated here. As a defense-in-depth measure, disable or restrict JavaScript execution for PDFs in Foxit's preferences, since the flaw depends on JavaScript embedded in the document. Remind users not to open PDFs from untrusted sources, and monitor for crash reports involving annotation rendering as an indicator of attempted exploitation.
Affected
| Foxit PDF Editor | — |
| Foxit PDF Reader | — |
Estimated exposure
massPlausibly tens of millions of desktop installations (order of 10M+), clearly an estimate — Foxit PDF Reader is free, widely distributed PDF software that the vendor has marketed with cumulative user/download counts in the hundreds of millions, so even a fraction of active installs yields a very large exposed base; exact…
Description
When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.