AI analysis
Foxit PDF Editor and Reader fail to enforce permission verification for Secure Reading Mode, a protection mechanism failure (CWE-693) that lets a malicious PDF silently trigger an outbound SMB authentication request without any security prompt. When a victim simply opens the crafted PDF, their Windows machine sends NTLM authentication responses (per the related ZDI advisory, via a construct such as the importIcon action) to an attacker-controlled SMB server, exposing the user's credential hash, which can be cracked offline or relayed for lateral movement. The flaw requires user interaction but no privileges, and affects both the free Reader and paid Editor products; per the CVSS vector, availability is also impacted (A:H). No public proof of concept is known and there is no evidence of in-the-wild exploitation, though the attack is trivially deliverable via emailed or downloaded PDFs.
What to do: Update Foxit PDF Editor/Reader to the latest version from Foxit's download page, since the fix ships in the current release and the advisory does not list a safe older version. Block outbound SMB (TCP 139/445) at host and perimeter firewalls and disable NTLM in favor of Kerberos where feasible, which neutralizes both hash capture and relay. Treat unsolicited PDFs as untrusted, confirm Secure Reading Mode is enabled, and monitor for NTLM authentication attempts to unexpected external hosts.
Affected
| Foxit PDF Editor | — |
| Foxit PDF Reader | — |
Estimated exposure
masslikely tens of millions of desktops worldwide (order of magnitude: 10M+) — Foxit's free Reader is one of the most widely downloaded Windows PDF readers with cumulative installs historically reported in the hundreds of millions, so even a partial active base plausibly exceeds 1M users.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.