Raw vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-12751 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Foxit Pdf Editor. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-12751 is an out-of-bounds read vulnerability in the AcroForm handling code of Foxit PDF Reader that can lead to remote code execution. The flaw stems from insufficient validation of user-supplied data, allowing a read past the end of an allocated buffer. Successful exploitation grants arbitrary code execution in the context of the current process. The issue was originally reported as ZDI-CAN-25344 and carries a CVSS 3.0 score of 7.8.
Remote attackers can exploit the vulnerability by convincing a target to open a malicious PDF file or visit a malicious page. No authentication or elevated privileges are required, though user interaction is necessary. The attack runs entirely within the reader's process and can result in full confidentiality, integrity, and availability impact on the affected system.
Foxit has published a security bulletin addressing the issue, and the Zero Day Initiative has released advisory ZDI-24-1737 that includes additional technical details for defenders.
The EPSS score for this CVE rose from a low baseline to a peak of 0.0504 on 2026-02-07 before receding to its current value of 0.0289, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51086
Vulnerability Data
Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit…
more
a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25344.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation directly finds out-of-bounds read flaws through static analysis, fuzzing, and dynamic bounds checks.
Secure engineering principles require bounds checking and memory-safe constructs that stop out-of-bounds reads from being introduced.
Process isolation confines the effects of an out-of-bounds read to the compromised process.
Input validation rejects malformed indices or lengths that would otherwise cause reads outside buffer bounds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.
Routine patching replaces vulnerable code containing out-of-bounds read flaws.
Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.