CVE-2024-7722 Overview
CVE-2024-7722 is a use-after-free vulnerability in Foxit PDF Reader and Foxit PDF Editor affecting the handling of Doc objects. Remote attackers can disclose sensitive information from affected installations when a user opens a crafted PDF file or visits a malicious page. The flaw stems from missing validation of an object's existence before operating on it [CWE-416]. While the vulnerability by itself leads to information disclosure, an attacker can chain it with other issues to execute arbitrary code in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-23702 and disclosed publicly as ZDI-24-1124.
Critical Impact
Remote attackers can trigger memory disclosure in Foxit PDF Reader through a malicious PDF, and chain the flaw with other bugs to achieve arbitrary code execution in the user's process context.
Affected Products
- Foxit PDF Reader (Windows)
- Foxit PDF Editor (Windows)
- Foxit PDF Editor variants distributed for Windows platforms
Discovery Timeline
- 2024-08-21 - CVE-2024-7722 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7722
Vulnerability Analysis
The vulnerability lives inside the JavaScript-facing Doc object implementation in Foxit PDF Reader. When PDF-embedded scripts invoke methods on a Doc object, the application performs operations without first confirming that the underlying object still exists. Once the backing object is released, subsequent access reads or manipulates freed memory. The result is a classic use-after-free condition that leaks memory contents back to the attacker-controlled script context.
Exploitation requires user interaction. The target must open a crafted PDF in Foxit PDF Reader or Foxit PDF Editor, or browse to a page that serves the file inline. Because the disclosed memory can include pointers and heap metadata, attackers commonly pair this bug with a separate memory-safety flaw to defeat address space layout randomization (ASLR) and stage arbitrary code execution in the process context of the current user.
Root Cause
The root cause is missing lifetime validation. The affected code path performs operations on a Doc object without checking whether the object reference is still valid. When script logic causes the object to be freed and then reused, the dangling reference produces the [CWE-416] use-after-free condition documented in the ZDI-24-1124 advisory.
Attack Vector
The attack vector is network-adjacent via a malicious document. An attacker hosts or delivers a crafted PDF containing JavaScript that manipulates Doc object lifetimes. When the victim opens the file with a vulnerable Foxit build, the malicious script triggers the free-then-reuse condition and reads uninitialized or previously freed heap contents. No authentication is required, but user interaction is mandatory to open the document.
No verified public proof-of-concept code is available. See the ZDI-24-1124 Advisory for additional technical context.
Detection Methods for CVE-2024-7722
Indicators of Compromise
- PDF files containing embedded JavaScript that repeatedly instantiates, destroys, and re-references Doc objects.
- Unexpected FoxitPDFReader.exe or FoxitPDFEditor.exe crashes with access-violation exceptions on freed heap regions.
- Foxit processes spawning child processes such as cmd.exe, powershell.exe, or performing outbound network connections shortly after opening a PDF.
Detection Strategies
- Inspect PDF attachments at the email gateway for suspicious /JS and /JavaScript entries that reference the Doc object model.
- Deploy behavior-based endpoint monitoring to flag Foxit processes that exhibit anomalous memory access patterns or unexpected process lineage.
- Correlate Foxit application crash telemetry (Windows Error Reporting) with recent PDF file opens to surface potential exploitation attempts.
Monitoring Recommendations
- Enable process creation and image load logging for FoxitPDFReader.exe and FoxitPDFEditor.exe and forward to a central SIEM.
- Monitor for outbound HTTP/S connections initiated by Foxit processes, which is atypical during normal document rendering.
- Track user download and open events for PDFs originating from untrusted external senders.
How to Mitigate CVE-2024-7722
Immediate Actions Required
- Upgrade Foxit PDF Reader and Foxit PDF Editor to the latest fixed version as listed in the vendor advisory.
- Disable JavaScript execution in Foxit PDF Reader and Foxit PDF Editor if patching cannot be performed immediately.
- Restrict inbound PDF attachments at email and web gateways from untrusted external sources pending patch deployment.
Patch Information
Foxit has published fixed builds in its security bulletins. Review the Foxit Security Bulletins and the ZDI-24-1124 Advisory to identify the specific fixed version applicable to your deployment and roll it out through standard software distribution channels.
Workarounds
- Disable JavaScript in Foxit application preferences under Preferences > JavaScript by unchecking Enable JavaScript Actions.
- Configure the Trust Manager to enforce Safe Reading Mode and block execution of untrusted content in PDF files.
- Associate PDF files with a hardened viewer or sandboxed browser rendering until affected endpoints are patched.
# Configuration example: disable Foxit JavaScript via registry (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v "bEnableJS" /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v "bEnableJS" /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
