Skip to main content

Foxit Releases Security Updates Affecting Foxit PDF Editor

Security updates address multiple vulnerabilities that could lead to remote code execution, information disclosure, privilege escalation, or DoS

Threat ID:
CC-4566
Threat Severity:
Medium
Published:
23 October 2024 3:22 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates address multiple vulnerabilities that could lead to remote code execution, information disclosure, privilege escalation, or DoS

Threat details

Proof-of-concept for CVE-2024-28888

Proof-of-concept exploit code has been published for CVE-2024-28888. NHS England National CSOC considers exploitation more likely.

Introduction

Foxit has released security updates to address multiple vulnerabilities in Foxit PDF Editor for Windows and MacOS. 

The most concerning vulnerability is a use-after-free vulnerability known as CVE-2024-28888 that could allow an attacker to achieve remote code execution (RCE) or gain information disclosure. Other vulnerabilities include privilege escalation, denial-of-service (DoS), and side-loading, which could allow attackers the ability to run malicious payloads.

Remediation advice

Affected organisations are encouraged to review the Foxit Security Bulletins (Release date October 18, 2024) and apply the relevant updates.   

Last edited: 23 October 2024 3:33 pm