Foxit Releases Security Updates Affecting Foxit PDF Reader and Foxit PDF Editor
Security updates address multiple vulnerabilities that could lead to remote code execution, information disclosure, privilege escalation, or DoS
Summary
Security updates address multiple vulnerabilities that could lead to remote code execution, information disclosure, privilege escalation, or DoS
Affected platforms
The following platforms are known to be affected:
Threat details
Proof-of-concept for CVE-2024-28888
Proof-of-concept exploit code has been published for CVE-2024-28888. NHS England National CSOC considers exploitation more likely.
Introduction
Foxit has released security updates to address multiple vulnerabilities in Foxit PDF Reader and Foxit PDF Editor as well as corresponding updates for Foxit PDF Editor for Mac and Foxit PDF Reader for Mac.
The most concerning vulnerability is a use-after-free vulnerability known as CVE-2024-28888 that could allow an attacker to achieve remote code execution (RCE) or gain information disclosure. Other vulnerabilities address privilege escalation, denial-of-service (DoS), and side-loading, which could allow attackers the ability to run malicious payloads.
Threat updates
| Date | Update |
|---|---|
| 7 Oct 2024 | Proof-of-concept code for the exploitation of CVE-2024-28888 has been published |
Remediation advice
Affected organisations are encouraged to review the following the Foxit Security Bulletins (Release date September 26, 2024) and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 7 October 2024 3:22 pm