CVE-2024-12752: Foxit PDF Editor AcroForm RCE Vulnerability

CVE-2024-12752 Overview

CVE-2024-12752 is a memory corruption vulnerability in Foxit PDF Reader and Foxit PDF Editor that allows attackers to execute arbitrary code in the context of the current user. The flaw resides in the handling of AcroForms and stems from insufficient validation of user-supplied data [CWE-119]. Exploitation requires user interaction, such as opening a malicious PDF file or visiting a malicious page that serves crafted content. The issue was reported through the Trend Micro Zero Day Initiative under identifier ZDI-CAN-25345 and published as advisory ZDI-24-1738. Successful exploitation grants the attacker the same privileges as the user running the vulnerable application.

Critical Impact
An attacker who convinces a user to open a malicious PDF can execute arbitrary code on the target system with the privileges of the current user.

Affected Products

Foxit PDF Reader on Microsoft Windows
Foxit PDF Editor on Microsoft Windows
Microsoft Windows host environments running vulnerable Foxit installations

Discovery Timeline

2024-12-30 - CVE-2024-12752 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12752

Vulnerability Analysis

The vulnerability is a memory corruption condition in the AcroForms handling logic of Foxit PDF Reader and Foxit PDF Editor. AcroForms are interactive form elements embedded inside PDF documents, processed by the reader when a document is opened or interacted with. The vulnerable code path fails to validate specific fields supplied by the document before operating on them in memory. An attacker who crafts a PDF with malformed AcroForm structures can trigger corruption of process memory. This condition is reachable during normal document rendering, meaning no additional privileges or authentication are required from the attacker side.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119]. The AcroForms parser trusts values embedded in the PDF instead of validating them against expected ranges or buffer sizes. Processing these values leads to memory being read or written outside the intended allocation, corrupting adjacent data structures. Attackers can leverage this state to influence control flow within the process.

Attack Vector

Exploitation requires local file access or user interaction. The victim must open a crafted PDF file with Foxit PDF Reader or Foxit PDF Editor, or visit a page that delivers the crafted document through the browser plugin. Because the code executes with the privileges of the current user, the attacker gains whatever access the victim account holds. Delivery vectors include phishing emails carrying malicious attachments, links to attacker-hosted PDFs, and drive-by delivery through compromised websites. See the Zero Day Initiative Advisory ZDI-24-1738 for additional technical detail.

Detection Methods for CVE-2024-12752

Indicators of Compromise

Foxit PDF Reader or Foxit PDF Editor processes (FoxitPDFReader.exe, FoxitPDFEditor.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or abnormal termination of the Foxit process shortly after opening a PDF, with faulting module logs pointing to AcroForm-related components.
Outbound network connections initiated by the Foxit process to unfamiliar domains or IP addresses following document open events.
PDF files containing unusually large or malformed AcroForm object definitions arriving through email or web downloads.

Detection Strategies

Monitor for process-lineage anomalies where Foxit binaries spawn scripting interpreters or shell processes.
Inspect PDF attachments at the mail gateway for AcroForm structures with abnormal object sizes or nested references.
Correlate Windows Error Reporting entries for Foxit process crashes with subsequent suspicious activity on the same host.
Enable exploit protection telemetry (DEP, ASLR, CFG violations) on hosts running Foxit software and forward events to a central analytics platform.

Monitoring Recommendations

Track Foxit application versions across the estate and alert when out-of-date builds are observed on active endpoints.
Alert on user-initiated PDF opens followed by process creation or network activity within a short time window.
Log file writes to user-writable directories by Foxit processes, particularly in AppData, Temp, and startup locations.

How to Mitigate CVE-2024-12752

Immediate Actions Required

Update Foxit PDF Reader and Foxit PDF Editor to the latest patched versions listed in the Foxit Security Bulletins.
Inventory all Windows endpoints running Foxit products and prioritize patch deployment on user-facing workstations.
Restrict opening of PDF attachments from untrusted sources at the mail gateway until patching is complete.
Educate users to avoid opening unsolicited PDF files, particularly those delivered by email or downloaded from unknown websites.

Patch Information

Foxit has released updated versions of Foxit PDF Reader and Foxit PDF Editor that address CVE-2024-12752. Refer to the Foxit Security Bulletins for the specific fixed versions and to the Zero Day Initiative Advisory ZDI-24-1738 for coordinated disclosure details. Apply vendor-provided updates through standard patch management workflows.

Workarounds

Disable JavaScript execution within Foxit PDF Reader and Foxit PDF Editor to reduce the attack surface of AcroForm processing.
Configure Foxit's Safe Reading Mode and Trust Manager to block execution of untrusted content.
Set an alternate default PDF handler for high-risk user groups until the patch is applied.
Apply application allowlisting policies that prevent Foxit processes from launching scripting interpreters or shell binaries.

bash

# Configuration example: enforce Foxit Safe Reading Mode via registry on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences" /v "bSafeMode" /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JSPrefs" /v "bEnableJS" /t REG_DWORD /d 0 /f