CVE-2022-28677: 
Foxit PDF Reader vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2022-28677) was discovered in Foxit PDF Reader version 11.2.1.53537. The vulnerability exists within the handling of Annotation objects and stems from the lack of validation when checking for object existence before performing operations (Zero Day Initiative, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the handling of Annotation objects, where the application fails to validate the existence of an object prior to performing operations on it. This is classified as a Use-After-Free (CWE-416) vulnerability (NVD, Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (Zero Day Initiative).

Foxit has released updates to address this vulnerability. Users should update their Foxit PDF Reader installations to versions newer than 11.2.1.53537 (Foxit Security Bulletin).