Executive Summary

This vulnerability occurs because the application's list box calculate array logic retains stale references to page or form objects even after those objects are deleted or recreated.

As a result, when the calculation runs, crafted documents can trigger a use-after-free condition, which means the application tries to use memory that has already been freed.

This can potentially allow an attacker to execute arbitrary code on the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows for potential arbitrary code execution through a use-after-free flaw in Foxit Reader when processing malicious PDF documents. Such a compromise can lead to unauthorized access, modification, or destruction of sensitive data.

Because the vulnerability impacts confidentiality, integrity, and availability of data (as indicated by the CVSS score), it can negatively affect compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive personal and health information against unauthorized access and breaches.

Exploitation of this vulnerability could result in data breaches or system compromise, potentially leading to violations of these regulations' requirements for data security and breach notification.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered by opening a crafted malicious PDF file that contains JavaScript exploiting the use-after-free condition in Foxit Reader. Detection involves monitoring for suspicious PDF files with embedded JavaScript that calls functions like deletePages() or triggers Calculate event callbacks.

Since the vulnerability is local and requires user interaction, network detection might focus on identifying delivery of suspicious PDFs or monitoring endpoint behavior for crashes or access violations related to Foxit Reader.

Specific commands to detect exploitation attempts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding opening untrusted or suspicious PDF documents, especially those received from unknown sources.

Update Foxit Reader to a version where this vulnerability is fixed, as the issue was confirmed in version 2025.3.0.35737 and likely addressed in subsequent releases.

Disable JavaScript execution within Foxit Reader if possible, to prevent malicious scripts embedded in PDFs from running.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including the possibility of arbitrary code execution.

An attacker could exploit this to run malicious code on your system, potentially leading to data theft, system compromise, or disruption of services.

The CVSS score of 7.8 indicates a high severity with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0