CVE-2024-30335: 
Foxit PDF Reader vulnerability analysis and mitigation

A vulnerability identified as CVE-2024-30335 was discovered in Foxit PDF Reader affecting the AcroForm Annotation functionality. The vulnerability was disclosed on March 28, 2024, and is related to an Out-Of-Bounds Read Information Disclosure issue. This security flaw affects installations of Foxit PDF Reader and requires user interaction for exploitation (Zero Day Initiative).

The vulnerability exists within the handling of Annotation objects in Foxit PDF Reader. The specific issue stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 score of 3.3 (LOW) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The flaw has been classified as CWE-125 (Out-of-bounds Read) (Zero Day Initiative).

The vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, but requires local access and user interaction (Zero Day Initiative).

Foxit has released security updates to address this vulnerability. Users are advised to update their applications to the latest version. The fix is available through the application's update feature by clicking on 'Help' > 'About Foxit PDF Reader' > 'Check for Update' or by downloading the latest version from the Foxit website (Foxit Security Bulletins).