UAF in Annotation Objects Enables Info Disclosure in Foxit PDF Reader
CVE-2023-38113 Published on May 3, 2024
Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21083.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2023-38113 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2023-38113
Want to know whenever a new CVE is published for Foxit Software Foxit Reader? stack.watch will email you.
Affected Versions
Foxit PDF Reader:- Version 12.1.2.15332 is affected.
- Version 12.1.2.15332 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.