CVE-2024-30362: 
Foxit PDF Reader vulnerability analysis and mitigation

A Use-After-Free vulnerability (CVE-2024-30362) was discovered in Foxit PDF Reader's PDF file parsing functionality. The vulnerability was reported on January 3, 2024, and publicly disclosed on March 28, 2024. This security flaw affects various versions of Foxit PDF Reader and requires user interaction to be exploited (ZDI Advisory).

The vulnerability exists within the parsing of PDF files and stems from the application's failure to validate the existence of an object prior to performing operations on it. The issue has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-416 (Use After Free) (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process on affected installations of Foxit PDF Reader. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. Specifically, the target must either visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges for execution (ZDI Advisory).

Foxit has released security updates to address this vulnerability. Users are advised to update their applications to the latest version through one of two methods: using the built-in update feature by clicking 'Help' > 'About Foxit PDF Reader' > 'Check for Update', or downloading the latest version directly from the Foxit website (Foxit Security Bulletin).