CVE-2024-25575: 
Foxit PDF Reader vulnerability analysis and mitigation

A type confusion vulnerability exists in Foxit Reader 2024.1.0.23997 that affects how the software handles Lock objects. The vulnerability was discovered by KPC of Cisco Talos and was assigned CVE-2024-25575. The issue was disclosed to the vendor on April 1, 2024, and a patch was released on April 28, 2024 (Talos Report).

The vulnerability occurs in the way Foxit Reader handles the fields property of the Lock object. When a specially crafted Javascript code inside a malicious PDF document triggers the vulnerability, it can lead to memory corruption. The issue stems from improper type validation when accessing the fields property of the Lock object after the deletePages method is called, which resets the fields property and assigns it to a different object type. This results in a type confusion vulnerability where the program attempts to use a string object as if it were a Field object (Talos Report). The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

If successfully exploited, this vulnerability can lead to arbitrary code execution. Depending on the memory layout of the process, an attacker could potentially gain arbitrary read and write access to memory (Talos Report).

The vulnerability can be exploited in two ways: either by tricking a user into opening a malicious PDF file, or if a user visits a specially crafted malicious website while the browser plugin extension is enabled (Talos Report).

Users should update to a version newer than Foxit Reader 2024.1.0.23997. The vendor has released a patch to address this vulnerability (Talos Report).