CVE-2023-38109: 
Foxit PDF Reader vulnerability analysis and mitigation

This vulnerability (CVE-2023-38109) affects Foxit PDF Reader and allows remote attackers to disclose sensitive information on affected installations. The vulnerability was discovered in May 2023 and publicly disclosed on July 26, 2023. The vulnerability specifically affects the handling of Doc objects in Foxit PDF Reader (Zero Day Initiative).

The vulnerability exists within the handling of Doc objects and results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 3.3 (Low) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires local access and user interaction to exploit (Zero Day Initiative).

When successfully exploited, this vulnerability allows attackers to disclose sensitive information. The vulnerability can potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

User interaction is required to exploit this vulnerability, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, but requires local access (Zero Day Initiative).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PDF Reader installations to the latest version. The fix is available through the official security bulletin (Foxit Security Bulletins).