CVE-2023-42094: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21873.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42094?
CVE-2023-42094 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-42094?
To fix CVE-2023-42094, update your Foxit PDF Reader or Foxit PhantomPDF to the latest version released after the vulnerability was disclosed.
What software versions are affected by CVE-2023-42094?
CVE-2023-42094 affects multiple versions of Foxit PDF Reader and Foxit PhantomPDF, including versions up to 12.1.3.15356 and specific versions between 10.1.12.37872 and 11.2.7.53812.
What is the impact of CVE-2023-42094 on systems?
The impact of CVE-2023-42094 allows remote attackers to execute arbitrary code on vulnerable installations, potentially compromising the system.
Does CVE-2023-42094 require user interaction to exploit?
Yes, CVE-2023-42094 requires user interaction, as the target must open a specially crafted PDF file for the exploit to be successful.