CVE-2021-34948: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2021-34948 is a Use-After-Free vulnerability in Foxit PDF Reader that was discovered in 2021. The vulnerability affects the handling of Square annotation objects in Foxit PDF Reader and allows remote attackers to execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file (Zero Day Initiative).

The specific flaw exists within the handling of Square annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 HIGH with the vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative).

An attacker can leverage this vulnerability to execute code in the context of the current process. The successful exploitation requires user interaction, but could lead to arbitrary code execution with the privileges of the current user (Zero Day Initiative).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. The attack can be performed remotely, though it requires local access vector (Zero Day Initiative).

Foxit has issued an update to correct this vulnerability. Users are advised to update their installations to the latest version of Foxit PDF Reader through the application's update mechanism or by downloading the latest version from the Foxit website (Zero Day Initiative, Foxit Security Bulletins).