CVE-2024-30341: Foxit PDF Editor RCE Vulnerability

CVE-2024-30341 Overview

CVE-2024-30341 is an out-of-bounds read vulnerability [CWE-125] in Foxit PDF Reader and Foxit PDF Editor. The flaw exists within the handling of Doc objects, where insufficient validation of user-supplied data allows a read past the end of an allocated buffer. Attackers can leverage this condition to execute arbitrary code in the context of the current process. Exploitation requires user interaction: the target must open a malicious PDF file or visit a malicious page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-22709 and published as ZDI-24-315.

Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the user running Foxit PDF Reader or Editor, providing a foothold for follow-on attacker activity.

Affected Products

Foxit PDF Reader (Windows)
Foxit PDF Editor (Windows)
Microsoft Windows host platform

Discovery Timeline

2024-04-02 - CVE-2024-30341 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30341

Vulnerability Analysis

The vulnerability resides in how Foxit PDF Reader parses and manipulates Doc objects embedded within PDF files. When the application processes attacker-controlled fields inside a crafted Doc object, it fails to validate the size or bounds of the referenced buffer. The resulting read operation extends beyond the allocated memory region, disclosing adjacent heap contents or corrupting downstream logic that relies on the returned data.

Attackers chain this out-of-bounds read with additional primitives to bypass memory protections such as Address Space Layout Randomization (ASLR). Once memory layout information leaks, the attacker steers execution flow to arbitrary code within the process context.

The attack requires local user interaction, meaning the victim must open a weaponized PDF or navigate to a page that automatically loads one through the browser plugin. No prior authentication is required.

Root Cause

The root cause is missing bounds validation in the Doc object handler. The parser trusts length or index fields supplied within the PDF structure and dereferences memory without confirming the target address falls within the allocated buffer. This maps to Common Weakness Enumeration [CWE-125]: Out-of-bounds Read.

Attack Vector

The attacker crafts a malicious PDF containing a manipulated Doc object and delivers it through phishing email, drive-by download, or a compromised web page rendered by the Foxit browser plugin. When the victim opens the document, the parser reads past the allocated buffer, and the attacker leverages the primitive to achieve arbitrary code execution.

No verified public exploit code has been released for CVE-2024-30341. See the ZDI advisory for further technical detail.

Detection Methods for CVE-2024-30341

Indicators of Compromise

Unexpected child processes spawned by FoxitPDFReader.exe or FoxitPDFEditor.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
PDF files received via email or downloaded from untrusted sources that contain malformed or unusually large Doc object structures.
Crash events or Windows Error Reporting entries referencing access violations inside the Foxit parsing modules.
Outbound network connections initiated by the Foxit process shortly after a document is opened.

Detection Strategies

Monitor process lineage for Foxit applications launching command interpreters or scripting engines, which is atypical behavior for a PDF viewer.
Inspect PDF attachments at the email gateway for embedded JavaScript and anomalous Doc object attributes.
Correlate document open events with subsequent module loads, memory allocations, and network activity within the Foxit process.

Monitoring Recommendations

Enable command-line and process creation logging (Windows Event ID 4688 with command-line auditing, or Sysmon Event ID 1) across endpoints running Foxit software.
Track file writes to user-writable directories such as %APPDATA% and %TEMP% originating from the Foxit process tree.
Alert on Foxit processes making outbound connections to newly registered or low-reputation domains after a PDF is opened.

How to Mitigate CVE-2024-30341

Immediate Actions Required

Inventory all endpoints running Foxit PDF Reader and Foxit PDF Editor and identify versions vulnerable per the vendor advisory.
Apply the patched release published in the Foxit Security Bulletins as soon as validation testing permits.
Restrict opening of PDF attachments from external senders through email gateway policy until patching completes.
Educate users about the risk of opening unsolicited PDF files and visiting untrusted links that render PDFs in-browser.

Patch Information

Foxit has released updated versions of PDF Reader and PDF Editor that remediate CVE-2024-30341. Refer to the Foxit Security Bulletins for the fixed version numbers and download locations. Deploy the updates through your standard software distribution tooling and confirm the installed version on each endpoint after deployment.

Workarounds

Disable the Foxit browser plugin and PDF preview handlers to prevent automatic rendering of untrusted documents.
Configure the operating system to open PDF files with a hardened or sandboxed viewer while the patch is being rolled out.
Apply Windows Attack Surface Reduction rules that block Office and PDF applications from creating child processes.
Enforce application allowlisting to prevent execution of unexpected binaries spawned by the Foxit process.

bash

# Example: block child process creation from Foxit binaries using Windows Defender ASR-style rules
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled