CVE-2023-42090: 
Foxit PDF Reader vulnerability analysis and mitigation

The vulnerability (CVE-2023-42090) is an Out-of-Bounds Read Information Disclosure vulnerability affecting Foxit PDF Reader. The vulnerability was discovered on July 13, 2023, and publicly disclosed on September 12, 2023. It specifically affects the handling of Doc objects within the PDF reader software (Zero Day Initiative).

The vulnerability exists within the handling of Doc objects in Foxit PDF Reader. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local access requirements and low impact (Zero Day Initiative).

When exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. The impact is limited to information disclosure, with no direct impact on system integrity or availability (Zero Day Initiative).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

Foxit has issued an update to correct this vulnerability. Users are advised to update their software to the latest version through the official Foxit website (Zero Day Initiative, Foxit Security).