CVE-2024-49576

CWE-416 — Use After Free3 documents3 sources
Severity
8.8HIGH
EPSS
0.1%
top 72.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Foxit PDF EditorFoxit PDF ReaderFoxit Foxit Reader
Timeline
PublishedDec 18

Description

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin exten…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDfoxit/pdf_reader2024.3.0.26795
▶CVEListV5foxit/foxit_reader2024.3.0.26795
▶NVDfoxit/pdf_editor12.0.0 — 12.1.8.15703+4

🔴Vulnerability Details

2
GHSA
GHSA-rx5r-j988-cf3j: A use-after-free vulnerability exists in the way Foxit Reader 2024↗2024-12-18
▶
CVEList
CVE-2024-49576: A use-after-free vulnerability exists in the way Foxit Reader 2024↗2024-12-18
▶