CVE-2024-9244: Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
First published: Fri Nov 22 2024(Updated: )
Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-23933.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Foxit Reader | ||
| Foxit PDF Editor for Windows | <=11.2.10.53951 | |
| Foxit PDF Editor for Windows | >=12.0<=12.1.7.15526 | |
| Foxit PDF Editor for Windows | >=13.0<=13.1.3.22478 | |
| Foxit PDF Editor for Windows | >=2023.0<=2023.3.0.23028 | |
| Foxit PDF Editor for Windows | >=2024.0<=2024.2.3.25184 | |
| Foxit PDF Reader | <=2024.2.3.25184 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9244?
CVE-2024-9244 has been rated with a severity level that indicates it allows local privilege escalation.
How do I fix CVE-2024-9244?
To fix CVE-2024-9244, update Foxit PDF Reader or Foxit PDF Editor to the latest version available.
Who is affected by CVE-2024-9244?
CVE-2024-9244 affects installations of Foxit PDF Reader and certain versions of Foxit PDF Editor on Windows.
Can CVE-2024-9244 be exploited remotely?
No, CVE-2024-9244 requires local access to exploit, making it a local privilege escalation vulnerability.
What versions of Foxit products are vulnerable to CVE-2024-9244?
CVE-2024-9244 affects Foxit PDF Reader versions up to 2024.2.3.25184 and specific ranges of Foxit PDF Editor versions.
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-1298
- alias/ZDI-CAN-23933
- alias/CVE-2024-9244
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/foxit
- canonical/foxit reader
- canonical/foxit pdf editor for windows
- version/foxit pdf editor for windows/11.2.10.53951
- version/foxit pdf editor for windows/12.0
- version/foxit pdf editor for windows/12.1.7.15526
- version/foxit pdf editor for windows/13.0
- version/foxit pdf editor for windows/13.1.3.22478
- version/foxit pdf editor for windows/2023.0
- version/foxit pdf editor for windows/2023.3.0.23028
- version/foxit pdf editor for windows/2024.0
- version/foxit pdf editor for windows/2024.2.3.25184
- canonical/foxit pdf reader
- version/foxit pdf reader/2024.2.3.25184