CVE-2024-9252: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2024-9252 is a Use-After-Free Information Disclosure vulnerability affecting Foxit PDF Reader. The vulnerability was discovered and reported on June 26, 2024, and publicly disclosed on September 26, 2024. This security flaw affects multiple versions of Foxit PDF Reader and Foxit PDF Editor for Windows, including versions up to 2024.2.3.25184 (NVD, ZDI Advisory).

The vulnerability exists within the handling of AcroForms in Foxit PDF Reader. The specific flaw results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH by NIST (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while Zero Day Initiative assigned it a score of 3.3 LOW (Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The vulnerability is classified as CWE-416 (Use After Free) (NVD, ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. The impact requires user interaction, specifically that the target must visit a malicious page or open a malicious file. An attacker can potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction for exploitation, specifically requiring the target to visit a malicious page or open a malicious file. The attack complexity is considered low, and no special privileges are required to execute the attack, though it requires local access to the system (NVD).

Foxit has released security updates to address this vulnerability. Users are advised to update to the latest versions of the affected software. For Version 2023.1 and higher, users can update by clicking on 'Help' > 'About Foxit PDF Reader' or 'About Foxit PDF Editor' > 'Check for Update'. Alternatively, users can download the updated version directly from the Foxit website (Foxit Security Bulletin).