A critical vulnerability has been identified in Foxit PDF Reader, tracked as CVE-2024-28888, which could allow attackers to execute arbitrary code on compromised systems. This memory corruption flaw, which has received a high CVSS score of 8.8, is linked to a use-after-free error in the way Foxit Reader processes checkbox field objects. The vulnerability can be exploited when users are tricked into opening malicious PDF files or visiting compromised websites while using the Foxit PDF Reader browser extension, potentially leading to severe security breaches.
The root of this vulnerability lies in Foxit PDF Reader’s support for JavaScript, which is utilized to create dynamic forms and interactive content through the V8 JavaScript engine. Attackers can exploit this support by crafting malicious PDFs that take advantage of the improper handling of checkbox field objects. Specifically, when the deletePages() function releases a checkbox field object without proper validation, it may lead to a pointer dereference that can result in arbitrary read and write access in the process memory structure, ultimately allowing attackers to execute arbitrary code.
Foxit Software has released patches in the latest versions of Foxit PDF Reader and Foxit PDF Editor, specifically v2024.3 and v13.1.4, to address these vulnerabilities. Users are strongly encouraged to upgrade their software as soon as possible to mitigate the risks associated with this critical vulnerability. Failing to do so may leave systems open to exploitation by malicious actors seeking to manipulate users into opening harmful documents or accessing dangerous websites.
In light of these developments, it is essential for users to remain vigilant and proactive in their cybersecurity practices. Regularly updating software and being cautious when handling untrusted documents are vital steps in maintaining a secure computing environment. By taking these precautions, users can better protect themselves against emerging threats that exploit vulnerabilities in widely used applications like Foxit PDF Reader.
