CVE-2023-32616: Use After Free
First published: Mon Nov 27 2023(Updated: )
A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Foxitsoftware Foxit Reader | =12.1.2.15356 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-32616?
CVE-2023-32616 is a use-after-free vulnerability in Foxit Reader 12.1.2.15356 that can lead to memory corruption and arbitrary code execution.
How does CVE-2023-32616 affect Foxit Reader?
CVE-2023-32616 affects Foxit Reader 12.1.2.15356 by allowing a specially crafted malicious PDF document to trigger memory corruption when handling 3D annotations.
What is the severity of CVE-2023-32616?
CVE-2023-32616 has a severity rating of 8.8, which is considered high.
How can CVE-2023-32616 be exploited?
CVE-2023-32616 can be exploited by including a specially crafted Javascript code inside a malicious PDF document.
Is there a fix for CVE-2023-32616?
Foxit Software has not released a fix for CVE-2023-32616 at the time of writing this FAQ.
- collector/mitre-cve
- collector/nvd-api
- agent/author
- agent/severity
- agent/references
- agent/type
- vendor/foxitsoftware
- canonical/foxitsoftware foxit reader
- version/foxitsoftware foxit reader/12.1.2.15356