CVE-2024-30326: 
Foxit PDF Reader vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2024-30326) was discovered in Foxit PDF Reader that allows remote attackers to execute arbitrary code. The vulnerability was discovered in the handling of Doc objects, where the application fails to validate the existence of an object before performing operations on it. This vulnerability was reported through the Zero Day Initiative program and was publicly disclosed on March 28, 2024 (ZDI Advisory).

The vulnerability exists within the handling of Doc objects in Foxit PDF Reader. The specific flaw stems from the application's failure to validate the existence of an object prior to performing operations on it. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a user to visit a malicious page or open a malicious file. Once triggered, the vulnerability can be leveraged to execute code in the context of the current process (ZDI Advisory).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PDF Reader to the latest version. The fix is available through the application's update mechanism or can be downloaded directly from Foxit's website (Foxit Security Bulletin).