Wiz
Vulnerability DatabaseCVE-2024-47810

CVE-2024-47810: 
Foxit PDF Reader vulnerability analysis and mitigation

Overview

A use-after-free vulnerability (CVE-2024-47810) exists in Foxit Reader 2024.3.0.26795 in the way it handles a 3D page object. The vulnerability was discovered by KPC of Cisco Talos and disclosed on December 18, 2024. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution (Talos Report).

Technical details

The vulnerability occurs when a page object is freed but its reference within a 3D object is not cleared, leading to a use-after-free condition. The issue is tracked as CWE-416 (Use After Free) and has received a CVSS v3.1 score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability exists in the JavaScript functionality of Foxit Reader, which uses the V8 JavaScript engine for handling interactive documents and dynamic forms (Talos Report).

Impact

The vulnerability can lead to memory corruption and potentially result in arbitrary code execution. An attacker could exploit this vulnerability either by tricking a user into opening a malicious PDF file or if a user visits a specially crafted website while the Foxit browser plugin extension is enabled (Talos Report).

Mitigation and workarounds

Foxit has released version 2024.4 to address this vulnerability. Users are encouraged to upgrade to this version or later immediately (Security Online).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo