CVE-2024-12751 Overview
CVE-2024-12751 is an out-of-bounds read vulnerability [CWE-125] in Foxit PDF Reader and Foxit PDF Editor. The flaw resides in the handling of AcroForms, where the application fails to properly validate user-supplied data. Attackers can leverage this vulnerability to execute arbitrary code in the context of the current process.
Exploitation requires user interaction. A target must open a malicious PDF file or visit a page that delivers one. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25344 and disclosed publicly as ZDI-24-1737.
Critical Impact
Remote attackers can achieve arbitrary code execution on affected Foxit PDF Reader and Editor installations when a user opens a crafted PDF document with a malicious AcroForm.
Affected Products
- Foxit PDF Reader
- Foxit PDF Editor
- Microsoft Windows platform installations
Discovery Timeline
- 2024-12-30 - CVE-2024-12751 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12751
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the AcroForms subsystem of Foxit PDF Reader and Editor. AcroForms is the interactive form technology embedded in the PDF specification. When Foxit parses form objects supplied by an untrusted document, it does not correctly validate size or offset fields against the underlying buffer allocation.
A crafted form structure causes the parser to read past the end of an allocated buffer. That memory disclosure can be paired with control over adjacent structures to corrupt program state. An attacker can chain the primitive with additional heap manipulation to redirect execution and run arbitrary code inside the Foxit process.
The flaw is classified under CWE-125: Out-of-bounds Read. Exploitation runs at the privilege level of the user opening the document.
Root Cause
The defect stems from missing bounds validation on attacker-controlled fields within an AcroForm object. Foxit's AcroForm parser trusts embedded length or index values without confirming they remain within the allocated buffer. That trust assumption allows adjacent heap memory to be read and processed as legitimate form data.
Attack Vector
An attacker delivers a malicious PDF through email, a download, or a compromised web page. When the victim opens the file, or visits a page that triggers rendering, the AcroForm parser processes the crafted form and triggers the out-of-bounds read. No authentication is required, but user interaction is mandatory.
The vulnerability manifests during document parsing before any user-visible form interaction. See the Zero Day Initiative advisory ZDI-24-1737 for additional technical context.
Detection Methods for CVE-2024-12751
Indicators of Compromise
- Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF, particularly with access violation exceptions.
- Foxit processes spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe from a document context.
- PDF files delivered via phishing that contain unusually large or malformed AcroForm dictionaries.
- Outbound network connections initiated by the Foxit process to previously unseen hosts after document open.
Detection Strategies
- Deploy YARA rules targeting anomalous /AcroForm, /XFA, and field dictionary structures in PDF documents traversing email and web gateways.
- Monitor Windows Event Log and Application Error entries for faulting modules inside the Foxit installation directory.
- Inspect endpoint telemetry for child-process creation events where the parent is a Foxit binary.
- Correlate PDF open events with subsequent script interpreter execution on the same host.
Monitoring Recommendations
- Enable command-line auditing and Sysmon process creation logging on endpoints running Foxit software.
- Alert on Foxit processes writing executables or DLLs to %TEMP%, %APPDATA%, or %PUBLIC%.
- Track versions of installed Foxit products through software inventory to identify unpatched hosts.
How to Mitigate CVE-2024-12751
Immediate Actions Required
- Update Foxit PDF Reader and Foxit PDF Editor to the fixed versions listed in the vendor advisory.
- Block inbound PDF attachments from untrusted senders at the mail gateway until patches are validated across the estate.
- Restrict PDF handler associations so that untrusted documents open in a sandboxed viewer or protected view.
- Educate users to avoid opening PDF attachments from unknown sources and to report suspicious documents.
Patch Information
Foxit has released fixed builds addressing the AcroForm out-of-bounds read. Refer to the Foxit Security Bulletin for the specific patched versions of Foxit PDF Reader and Foxit PDF Editor and apply the update to all affected Windows installations.
Workarounds
- Disable JavaScript in Foxit PDF Reader and Editor through Preferences > JavaScript to reduce the exploit surface exposed by AcroForms.
- Enable Foxit Safe Reading Mode to restrict active content execution when opening untrusted documents.
- Apply application control policies that prevent Foxit binaries from launching script interpreters or shells.
# Example: Group Policy registry keys to enforce Foxit Safe Reading Mode on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\General" /v "bSafeMode" /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\General" /v "bSafeMode" /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
