Command Injection in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2024-25858

Vulnerability identifier: #VU87283

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-25858

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when processing JavaScript inside PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary commands with malicious parameters.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

Install updates from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - update to 2024.1.0.23997
Foxit PDF Reader for Windows - update to 2024.1.0.23997

• https://www.foxit.com/support/security-bulletins.html

• Multiple vulnerabilities in Foxit PDF Reader and Editor for Windows