CVE-2024-28888: Use After Free
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28888?
CVE-2024-28888 is considered a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-28888?
To fix CVE-2024-28888, update Foxit Reader to the latest version available from the official website.
What causes CVE-2024-28888?
CVE-2024-28888 is caused by a use-after-free vulnerability in how Foxit Reader handles checkbox field objects.
Who is affected by CVE-2024-28888?
Users of Foxit Reader version 2024.1.0.23997 are affected by CVE-2024-28888.
What can an attacker achieve with CVE-2024-28888?
An attacker exploiting CVE-2024-28888 can lead to memory corruption, which may result in executing arbitrary code on the victim's machine.