CVE-2023-38116: 
Foxit PDF Reader vulnerability analysis and mitigation

Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2023-38116) was discovered and disclosed on July 26, 2023. This vulnerability affects Foxit PDF Reader installations and requires user interaction to be exploited, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability exists within the handling of Doc objects in Foxit PDF Reader. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (Low) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (ZDI Advisory).

When successfully exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. The vulnerability can potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a target to either visit a malicious webpage or open a malicious file. The attack complexity is considered low, requiring no privileges but does need user interaction (ZDI Advisory).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PDF Reader installations to the latest version. The fix is available through the application's update mechanism or can be downloaded directly from Foxit's website (Foxit Security Bulletin).