CVE-2024-30325: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2024-30325 is a Use-After-Free vulnerability affecting Foxit PDF Reader. The vulnerability was discovered in November 2023 and publicly disclosed on March 28, 2024. This security flaw affects installations of Foxit PDF Reader and allows remote attackers to execute arbitrary code on affected systems (Zero Day Initiative).

The vulnerability exists within the handling of Doc objects in AcroForms. The specific issue results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. The successful exploitation requires user interaction, where the target must visit a malicious page or open a malicious file (Zero Day Initiative).

Foxit has released security updates to address this vulnerability. Users are advised to update their applications to the latest version. The fix is available in Foxit PDF Reader 2024.4 and Foxit PDF Editor 2024.4/13.1.5 (Foxit Security Bulletin).