CVE-2023-38573: Use After Free
First published: Mon Nov 27 2023(Updated: )
A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Foxitsoftware Foxit Reader | =12.1.2.15356 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-38573?
CVE-2023-38573 is a use-after-free vulnerability in Foxit Reader 12.1.2.15356.
How does CVE-2023-38573 affect Foxit Reader?
CVE-2023-38573 can lead to memory corruption and arbitrary code execution in Foxit Reader 12.1.2.15356.
What is the severity of CVE-2023-38573?
CVE-2023-38573 has a severity rating of 8.8 (high).
How can I fix CVE-2023-38573?
To fix CVE-2023-38573, it is recommended to update to a version of Foxit Reader that is not affected by the vulnerability.
What is CWE-416?
CWE-416 is a vulnerability in Foxit Reader 12.1.2.15356 that allows the reuse of a previously freed object, leading to memory corruption and arbitrary code execution.
- collector/nvd-api
- agent/author
- agent/severity
- agent/weakness
- agent/tags
- agent/event
- agent/type
- agent/references
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/foxitsoftware
- canonical/foxitsoftware foxit reader
- version/foxitsoftware foxit reader/12.1.2.15356