CVE-2024-30330 Overview
CVE-2024-30330 is a use-after-free vulnerability [CWE-416] in Foxit PDF Reader that allows attackers to execute arbitrary code on affected installations. The flaw resides in the handling of Doc objects within AcroForms and stems from the lack of validation that an object exists before performing operations on it. Exploitation requires user interaction: the target must open a malicious PDF file or visit a page that delivers one. Successful exploitation grants code execution in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-22636 and is tracked publicly as ZDI-24-309.
Critical Impact
Attackers can execute arbitrary code in the context of the Foxit PDF Reader process when a user opens a crafted PDF, leading to full compromise of the application's privileges on the host.
Affected Products
- Foxit PDF Reader on Microsoft Windows
- Foxit PDF Editor on Microsoft Windows
- Microsoft Windows host platform
Discovery Timeline
- 2024-04-03 - CVE-2024-30330 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30330
Vulnerability Analysis
The vulnerability is a use-after-free condition in the AcroForm subsystem of Foxit PDF Reader. AcroForm is Adobe's interactive form technology and is implemented in Foxit via a JavaScript engine that exposes Doc objects to embedded scripts. When JavaScript inside a PDF references a Doc object that has already been released, Foxit fails to validate that the underlying object is still present before invoking methods or accessing members on it. The dangling reference can then be reallocated with attacker-controlled data, giving the attacker control over object dispatch and, ultimately, native code execution within the reader process.
Root Cause
The root cause is missing object lifetime validation. The code path that operates on Doc objects inside AcroForms does not verify that the object still exists before dereferencing it. This is a classic memory safety failure classified under [CWE-416] Use After Free, in which freed memory is accessed as if it were still valid.
Attack Vector
Exploitation requires user interaction. An attacker crafts a PDF containing malicious JavaScript that triggers premature release of a Doc object and then reuses the freed reference. The victim opens the PDF in Foxit PDF Reader or Foxit PDF Editor, or navigates to a web page that opens the file in the reader. Code then executes at the privilege level of the current user. Refer to the Zero Day Initiative Advisory ZDI-24-309 for the technical write-up.
Detection Methods for CVE-2024-30330
Indicators of Compromise
- Unexpected child processes spawned by FoxitPDFReader.exe or FoxitPDFEditor.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
- PDF files containing embedded JavaScript that references AcroForm Doc objects across event handlers or delays object access via timers.
- Crash dumps or Windows Error Reporting entries citing access violations in Foxit modules while a PDF with AcroForms is open.
- Outbound network connections initiated by the Foxit process shortly after a PDF is opened.
Detection Strategies
- Hunt for process ancestry where a Foxit reader or editor process is the parent of a shell, script interpreter, or LOLBin.
- Inspect email gateways and web proxies for PDF attachments containing JavaScript actions that manipulate AcroForm objects.
- Correlate file open events on .pdf documents with subsequent write activity in user-writable directories such as %APPDATA% and %TEMP%.
Monitoring Recommendations
- Enable command-line and module-load logging on endpoints running Foxit products and forward events to a central analytics platform.
- Alert on DLL loads from unusual paths inside the Foxit process address space.
- Track version telemetry for FoxitPDFReader.exe and FoxitPDFEditor.exe to identify hosts still running unpatched builds.
How to Mitigate CVE-2024-30330
Immediate Actions Required
- Update Foxit PDF Reader and Foxit PDF Editor to the fixed versions listed in the Foxit Security Bulletins.
- Inventory endpoints for installed Foxit versions and prioritize patching systems that handle externally sourced PDFs.
- Block or sandbox PDF attachments from untrusted senders at the email gateway pending patch deployment.
Patch Information
Foxit has released fixed builds. Consult the Foxit Security Bulletins for the exact patched version numbers for Foxit PDF Reader and Foxit PDF Editor on Windows. Deploy the updates through your standard software distribution channel and validate installation with version checks.
Workarounds
- Disable JavaScript execution in Foxit PDF Reader and Foxit PDF Editor via Preferences → JavaScript until the patch is applied.
- Configure the Trust Manager to enforce Safe Reading Mode for PDFs from untrusted sources.
- Restrict opening of PDFs from external sources through application allow-listing or browser download policies.
- Run Foxit products under standard user accounts to limit the impact of successful exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
