Cyber Resilience

CVE-2024-30357

High

Published: 02 April 2024

Published
02 April 2024
Modified
08 August 2025
KEV Added
—
Patch
—
CVSS Score v3 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0123 79.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-30357 is a high-severity Type Confusion (CWE-843) vulnerability in Foxit Pdf Editor. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must…

more

visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22818.

CWE(s)
CWE-843

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

foxit
pdf editor
≤ 11.1.6.0109 · 12.0.0.0601 — 12.1.2.55366 · 13.0.0.61829 — 13.0.1.61866
foxit
pdf reader
≤ 2023.3.0.63083 · ≤ 2023.3.0.23028

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References