Foxit Software Foxit Reader

RCE Stack Buffer Overflow in Foxit Reader Plugin 2.2.1.530
CVE-2013-10068 - August 05, 2025

Foxit Reader Plugin version 2.2.1.530, bundled with Foxit Reader 5.4.4.11281, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer, allowing remote attackers to execute arbitrary code.

Stack Overflow

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability
CVE-2024-12751 - December 30, 2024

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25344.

Out-of-bounds Read

Foxit PDF Reader AcroForm Memory Corruption RCE
CVE-2024-12752 - December 30, 2024

Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25345.

Buffer Overflow

Foxit PDF Reader Installer Local Privilege Escalation via Junction Creation
CVE-2024-12753 7.3 - High - December 30, 2024

Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. By creating a junction, an attacker can abuse the installer process to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25408.

insecure temporary file

Foxit Reader 3D Page Object Use-After-Free Vulnerability
CVE-2024-47810 8.8 - High - December 18, 2024

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit Reader Use-After-Free Vulnerability in CBF_Widget Object
CVE-2024-49576 8.8 - High - December 18, 2024

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit PDF Reader AcroForm Use-After-Free Info Disclosure
CVE-2024-9252 7.8 - High - November 22, 2024

Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24491.

Dangling pointer

UAF in Foxit Reader 2024.1.0.23997 Checkbox Field
CVE-2024-28888 8.8 - High - October 02, 2024

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit PDF Reader AcroForm Use-After-Free RCE
CVE-2024-7725 8.8 - High - August 21, 2024

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23928.

Dangling pointer

Foxit PDF Reader Use-After-Free Info-Disclosure in PDF Parsing
CVE-2021-34973 5.5 - Medium - May 07, 2024

Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14968.

Foxit PDF Reader UAF in Annotation Handling Enables Remote Code Execution
CVE-2021-34974 - May 07, 2024

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15167.

Foxit PDF Reader UAF CVE-2021-34976: Remote Info Disclosure
CVE-2021-34976 5.5 - Medium - May 07, 2024

Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14659.

UAF in Annotation Objects Enables Info Disclosure in Foxit PDF Reader
CVE-2023-38113 - May 03, 2024

Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21083.

Foxit Reader 2024.1.0.23997 Use-After-Free in ComboBox Widget
CVE-2024-25648 8.8 - High - April 30, 2024

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Type Confusion in Foxit Reader 2024.1.0.23997 via JavaScript => Arbitrary Exec
CVE-2024-25575 8.8 - High - April 30, 2024

A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Object Type Confusion

Foxit Reader 12.1.2.15356: UAF via 3D Annotation JS
CVE-2023-32616 8.8 - High - November 27, 2023

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit Reader 12.1.3.15356: File Creation via JS exportDataObject API
CVE-2023-35985 8.8 - High - November 27, 2023

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.

External Control of File Name or Path

UAOF in Foxit Reader 12.1.2.15356: Code Exec via Signature Field
CVE-2023-38573 8.8 - High - November 27, 2023

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

Foxit Reader 12.1.3.15356 JS saveAs API RCE
CVE-2023-39542 8.8 - High - November 27, 2023

A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

External Control of File Name or Path

Foxit Reader 12.1.3.15356 JS API arbitrary file creation CVE-2023-40194
CVE-2023-40194 8.8 - High - November 27, 2023

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

External Control of File Name or Path

Foxit Reader 12.1.2.15356 Field Value Type Confusion Arbitrary Code Exec
CVE-2023-41257 8.8 - High - November 27, 2023

A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Object Type Confusion

Use-after-free in Foxit Reader 12.1.2.15332 via PDF JS arbitrary code execution
CVE-2023-33876 8.8 - High - July 19, 2023

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Dangling pointer

RCE in Foxit PDF Reader 11.2.2.53575 AcroForms (CVE-2022-37391)
CVE-2022-37391 7.8 - High - March 29, 2023

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17661.

Dangling pointer

Foxit Reader 11.2.118.51569 DLL Search Path Priv Esc
CVE-2022-43310 7.8 - High - November 09, 2022

An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when searching for DLL libraries without specifying an absolute path.

DLL preloading

Foxit PDF Reader/Editor UAF via JS (before 11.1/10.1.6)
CVE-2021-41785 7.8 - High - August 29, 2022

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.

Dangling pointer

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4
CVE-2021-38568 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.

Memory Corruption

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4
CVE-2021-38569 7.5 - High - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects.

Stack Exhaustion

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4
CVE-2021-38573 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4
CVE-2021-38574 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.

SQL Injection

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4
CVE-2021-38570 9.1 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.

insecure temporary file

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4
CVE-2021-38572 9.8 - Critical - August 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4
CVE-2021-33794 9.1 - Critical - August 11, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key during XFA form interaction.

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write
CVE-2021-33793 9.8 - Critical - August 11, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.

Memory Corruption

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures
CVE-2021-33795 5.5 - Medium - July 09, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled.

Improper Handling of Exceptional Conditions

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write
CVE-2021-33792 7.8 - High - July 09, 2021

Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.

Memory Corruption

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598
CVE-2021-21822 8.8 - High - May 10, 2021

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.

Dangling pointer

In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory
CVE-2020-13548 8.8 - High - February 10, 2021

In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

A type confusion vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527
CVE-2020-13547 8.8 - High - December 22, 2020

A type confusion vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger an improper use of an object, resulting in memory corruption and arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Memory Corruption

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527
CVE-2020-13557 8.8 - High - December 22, 2020

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527
CVE-2020-13560 8.8 - High - December 22, 2020

A use after free vulnerability exists in the JavaScript engine of Foxit Softwares Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.0.37527
CVE-2020-13570 8.8 - High - December 22, 2020

A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger the reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Dangling pointer

An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier
CVE-2020-28203 5.5 - Medium - December 15, 2020

An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier. There is a null pointer access/dereference while opening a crafted PDF file, leading the application to crash (denial of service).

NULL Pointer Dereference

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API
CVE-2020-14425 7.8 - High - November 02, 2020

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.

An issue was discovered in Foxit Reader and PhantomPDF before 10.1
CVE-2020-26535 9.8 - Critical - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. If TslAlloc attempts to allocate thread local storage but obtains an unacceptable index value, V8 throws an exception that leads to a write access violation (and read access violation).

Memory Corruption

An issue was discovered in Foxit Reader and PhantomPDF before 10.1
CVE-2020-26537 9.8 - Critical - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation, the number of outputs is unequal to the number of color components in a color space. This causes an out-of-bounds write.

Memory Corruption

An issue was discovered in Foxit Reader and PhantomPDF before 10.1
CVE-2020-26539 9.8 - Critical - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field dictionaries), a use-after-free can occur with resultant remote code execution (or an information leak).

Dangling pointer

An issue was discovered in Foxit Reader and PhantomPDF before 10.1
CVE-2020-26538 7.8 - High - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory.

An issue was discovered in Foxit Reader and PhantomPDF before 10.1
CVE-2020-26536 5.5 - Medium - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is a NULL pointer dereference via a crafted PDF document.

NULL Pointer Dereference

An issue was discovered in Foxit Reader and PhantomPDF before 10.1
CVE-2020-26534 9.8 - Critical - October 02, 2020

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is an Opt object use-after-free related to Field::ClearItems and Field::DeleteOptions, during AcroForm JavaScript execution.

Dangling pointer

FoxitReader.exe in Foxit Reader 9.3.0.10826
CVE-2018-19389 5.5 - Medium - November 20, 2018

FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via BMP data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue.

Out-of-bounds Read