CVE-2024-30340: 
Foxit PDF Reader vulnerability analysis and mitigation

Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2024-30340) was discovered and disclosed on April 2, 2024. This vulnerability affects Foxit PDF Reader installations and requires user interaction to exploit, specifically requiring the target to visit a malicious page or open a malicious file (Zero Day Initiative).

The vulnerability exists within the handling of Annotation objects in Foxit PDF Reader. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (LOW) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (Zero Day Initiative).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

The vulnerability requires user interaction to exploit, specifically requiring the target to visit a malicious page or open a malicious file. The attack complexity is considered low, requires no privileges, but does need user interaction (Zero Day Initiative).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PDF Reader to the latest version. The fix is available in Foxit PDF Reader 2024.4 and Foxit PDF Editor 2024.4/13.1.5. Users can update their applications through the built-in update feature or download the latest version from the Foxit website (Foxit Security Bulletin).