CVE-2023-38115: 
Foxit PDF Reader vulnerability analysis and mitigation

Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2023-38115) was discovered in May 2023 and disclosed in July 2023. This vulnerability affects Foxit PDF Reader installations and requires user interaction to be exploited, specifically requiring the target to visit a malicious page or open a malicious file (Zero Day Initiative).

The vulnerability exists within the handling of Doc objects in Foxit PDF Reader. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 3.3 (Low) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (Zero Day Initiative).

When exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. The vulnerability could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

The vulnerability requires user interaction for exploitation, specifically requiring the target to visit a malicious page or open a malicious file. The attack complexity is considered low, but requires local access and user interaction (Zero Day Initiative).

Foxit has issued an update to correct this vulnerability. Users are advised to update their Foxit PDF Reader installations to the latest version through the application's update mechanism or by downloading the latest version from the Foxit website (Zero Day Initiative, Foxit Security Bulletins).