CVE-2023-51555: 
Foxit PDF Reader vulnerability analysis and mitigation

A vulnerability identified as CVE-2023-51555 was discovered in Foxit PDF Reader, affecting the handling of Doc objects. The vulnerability was disclosed on December 20, 2023, and allows remote attackers to disclose sensitive information on affected installations. User interaction is required for exploitation, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data when handling Doc objects, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 score of 3.3 (LOW) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The flaw is classified as CWE-125 (Out-of-bounds Read) (ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information on affected installations of Foxit PDF Reader. While the direct impact is limited to information disclosure, attackers could potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requires no privileges, but does need user interaction (ZDI Advisory).

Foxit has released security updates to address this vulnerability. Users are advised to update their applications to the latest version. For Version 2023.1 and higher, users can update by clicking on 'Help' > 'About Foxit PDF Reader' > 'Check for Update'. Alternatively, users can download the updated version directly from the Foxit website (Foxit Security Bulletin).