PT-2023-7964 · Foxit · Foxit Pdf Reader+1

Published

2023-10-03

·

Updated

2025-08-13

·

CVE-2023-51556

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Foxit PDF Reader (affected versions not specified) Foxit PDF Editor (affected versions not specified)
Description The issue is related to a use-after-free vulnerability in the handling of Doc objects within Foxit PDF Reader and Foxit PDF Editor. This vulnerability allows remote attackers to execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, such as visiting a malicious page or opening a malicious file. The flaw exists due to the lack of validating the existence of an object prior to performing operations on it, allowing an attacker to execute code in the context of the current process.
Recommendations For Foxit PDF Reader, update to a version that addresses the use-after-free vulnerability in the handling of Doc objects. For Foxit PDF Editor, update to a version that addresses the use-after-free vulnerability in the handling of Doc objects. As a temporary workaround, consider disabling the handling of Doc objects in Foxit PDF Reader and Foxit PDF Editor until a patch is available. Restrict access to malicious pages or files to minimize the risk of exploitation.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-09048
CVE-2023-51556
ZDI-23-1869

Affected Products

Foxit Pdf Editor
Foxit Pdf Reader