CVE-2024-30351: 
Foxit PDF Reader vulnerability analysis and mitigation

A Use-After-Free vulnerability (CVE-2024-30351) was discovered in Foxit PDF Reader's AcroForm handling functionality. The vulnerability was reported on December 20, 2023, and publicly disclosed on March 28, 2024. This security flaw affects the handling of Doc objects in AcroForms within Foxit PDF Reader (Zero Day Initiative).

The vulnerability stems from the application's failure to validate the existence of an object before performing operations on it, specifically within the handling of Doc objects in AcroForms. The issue has been assigned a CVSS v3.0 score of 7.8 (HIGH) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access requirements but high impact potential (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The exploitation requires user interaction, specifically the target must visit a malicious page or open a malicious file (Zero Day Initiative).

The vulnerability requires user interaction for successful exploitation. An attacker needs to convince a user to visit a malicious page or open a malicious file to trigger the vulnerability. Once triggered, the attacker can leverage this flaw to execute code in the context of the current process (Zero Day Initiative).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PDF Reader to the latest version. The fix is available through the application's built-in update mechanism or can be downloaded directly from Foxit's website (Foxit Security Bulletin).