Main Vulnerability Database Vulnerabilities #VU89811

Time-of-check Time-of-use (TOCTOU) Race Condition in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2024-29072

Published: May 24, 2024

Vulnerability identifier: #VU89811

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29072

CWE-ID: CWE-367

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition during the application update. A local user can execute arbitrary code with elevated privileges.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

Install updates from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - update to 2024.2.2.64388
Foxit PDF Reader for Windows - update to 2024.2.2.25170