CVE-2024-41605 Overview
CVE-2024-41605 affects Foxit PDF Reader before version 2024.3 and Foxit PDF Editor before versions 2024.3 and 13.1.4. The vulnerability resides in the update service, which lacks integrity validation for the updater component. An attacker with local access can replace an update file with a Trojan horse via side loading. The update service then executes the attacker-controlled binary, resulting in arbitrary code execution in the context of the update process. The flaw maps to [CWE-284] Improper Access Control.
Critical Impact
Attackers with local access can execute arbitrary code by side loading a malicious update file that the Foxit update service loads without integrity checks.
Affected Products
- Foxit PDF Reader versions before 2024.3
- Foxit PDF Editor versions before 2024.3
- Foxit PDF Editor 13.x versions before 13.1.4
Discovery Timeline
- 2024-09-26 - CVE-2024-41605 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-41605
Vulnerability Analysis
The vulnerability exists in the Foxit update service responsible for retrieving and executing updater components on Windows endpoints. The service consumes update files from a predictable location on the local file system without verifying their authenticity. Because there is no cryptographic signature check or integrity validation, an attacker who can write to that location can substitute the legitimate updater with a malicious executable. When the update service runs, it loads and executes the substituted file. This grants the attacker code execution under the privileges of the update process. The attack requires local access but no user interaction and no prior privileges beyond the ability to write the target file. See the Foxit Security Bulletins for vendor detail.
Root Cause
The root cause is missing integrity validation in the update service. The service does not verify a digital signature, hash, or publisher on the updater binary before invoking it. This is a classic [CWE-284] Improper Access Control condition applied to an auto-update workflow. Any writable directory used by the updater becomes a trust boundary the attacker can cross.
Attack Vector
An attacker first establishes local presence on the target system, typically through phishing, a prior foothold, or a low-privileged account. The attacker then writes a Trojan horse binary in place of the legitimate updater file. On the next update cycle, the Foxit update service loads and executes the malicious file. The result is code execution and potential privilege escalation depending on the service context.
No verified public exploit code is available. See the Foxit Security Bulletins for vendor technical detail.
Detection Methods for CVE-2024-41605
Indicators of Compromise
- Unexpected file writes or replacements to Foxit updater directories under %ProgramFiles%\Foxit Software\ or %LOCALAPPDATA%\Foxit Software\.
- Foxit update service processes spawning unsigned or non-Foxit child processes.
- Update binaries lacking a valid Foxit Software Inc. Authenticode signature.
Detection Strategies
- Monitor process lineage for the Foxit update service and flag child processes whose parent image is the updater but whose signature does not chain to Foxit.
- Alert on file modification events targeting Foxit updater executables from non-installer processes.
- Correlate low-privileged user file writes to Foxit directories with subsequent update service execution events.
Monitoring Recommendations
- Enable file integrity monitoring on Foxit installation and updater directories on all endpoints running Foxit PDF Reader or Editor.
- Ingest endpoint process, file, and signature telemetry into a SIEM and build detections for unsigned binaries executed by the Foxit updater.
- Baseline expected updater versions across the fleet and alert on out-of-band binary changes.
How to Mitigate CVE-2024-41605
Immediate Actions Required
- Upgrade Foxit PDF Reader to version 2024.3 or later on all affected endpoints.
- Upgrade Foxit PDF Editor to 2024.3, or upgrade 13.x installations to 13.1.4 or later.
- Restrict write permissions on the Foxit installation and updater directories to administrators only.
- Audit endpoints for unexpected files in Foxit updater paths before patching.
Patch Information
Foxit addresses CVE-2024-41605 in Foxit PDF Reader 2024.3, Foxit PDF Editor 2024.3, and Foxit PDF Editor 13.1.4. Consult the Foxit Security Bulletins for the authoritative patch list and download links.
Workarounds
- Apply strict Access Control Lists (ACLs) on Foxit updater directories so only privileged accounts can modify updater files.
- Disable the Foxit automatic update service on endpoints where patching cannot be applied immediately, and manage updates through a controlled software distribution channel.
- Enforce application allowlisting to block execution of unsigned binaries from user-writable locations.
# Configuration example: restrict write access on Foxit updater directory (Windows)
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" /inheritance:r
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
