CVE-2024-25648: 
Foxit PDF Reader vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2024-25648) exists in Foxit Reader 2024.1.0.23997's handling of ComboBox widgets. The vulnerability allows attackers to trigger memory corruption and potentially execute arbitrary code through specially crafted JavaScript code within malicious PDF documents. The vulnerability was discovered by KPC of Cisco Talos and was publicly disclosed on April 30, 2024 (Talos Report).

The vulnerability occurs when Foxit Reader handles a ComboBox widget object. When a specially crafted JavaScript code inside a PDF document triggers the Format event of a ComboBox widget, it can lead to the reuse of a previously freed object. The vulnerability is tracked as CWE-416 (Use After Free) and has received a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (Talos Report).

If successfully exploited, this vulnerability can lead to memory corruption and potentially result in arbitrary code execution. The impact is particularly severe as it affects both local file opening scenarios and cases where users visit malicious websites with the browser plugin extension enabled (Talos Report).

Exploitation requires either tricking a user into opening a malicious PDF file or visiting a specially crafted malicious website with the browser plugin extension enabled. The vulnerability can be triggered through carefully crafted JavaScript code that manipulates the ComboBox widget's Format event (Talos Report).

The vulnerability has been addressed in Foxit PDF Editor 2024.2. Users are advised to update to the latest version to protect against this vulnerability (FortiGuard Labs).