VYPR
← All advisories
High severity8.8NVD Advisory· Published Apr 30, 2024· Updated Jun 17, 2026

CVE-2024-25648

CVE-2024-25648

Description

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Foxitsoftware/PDF Editor3 versions
    cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*range: <=11.2.8.53842
    • cpe:2.3:a:foxit:pdf_editor:2024.1.0.23997:*:*:*:*:*:*:*
    • cpe:2.3:a:foxit:pdf_editor:2024.1.0.63682:*:*:*:*:*:*:*
  • Foxitsoftware/PDF Reader2 versions
    cpe:2.3:a:foxit:pdf_reader:2024.1.0.23997:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:foxit:pdf_reader:2024.1.0.23997:*:*:*:*:*:*:*
    • cpe:2.3:a:foxit:pdf_reader:2024.1.0.63682:*:*:*:*:*:*:*
  • Foxitsoftware/Readerllm-create
    Range: 2024.1.0.23997
  • Foxitsoftware/Foxit Reader Plugincpe-rescue
    Range: 2024.1.0.23997

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.