CVE-2024-9243: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2024-9243 Overview

CVE-2024-9243 is a use-after-free vulnerability [CWE-416] in Foxit PDF Reader and Foxit PDF Editor. The flaw resides in the handling of AcroForm objects, where the application performs operations on an object without validating its existence. Attackers can leverage the condition to execute arbitrary code in the context of the current process. Exploitation requires user interaction: the target must open a malicious PDF file or visit a malicious page that serves crafted content. The issue was reported through the Zero Day Initiative as ZDI-CAN-23932 and published as advisory ZDI-24-1296.

Critical Impact
Successful exploitation yields arbitrary code execution in the user's security context, enabling malware installation, data theft, or pivoting from a workstation opening an untrusted PDF.

Affected Products

Foxit PDF Reader (Windows and macOS)
Foxit PDF Editor (Windows and macOS)
Products handling AcroForm content prior to the vendor fix

Discovery Timeline

2024-11-22 - CVE-2024-9243 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9243

Vulnerability Analysis

The vulnerability is a use-after-free condition in the AcroForm subsystem of Foxit PDF Reader and Foxit PDF Editor. AcroForm is Adobe's interactive form technology, which Foxit implements to support JavaScript-driven form fields, actions, and document events. When the application processes a crafted form, code paths operate on an object that has already been freed, or that never existed in the expected state.

An attacker who controls the freed memory region can place a counterfeit object at the reused address. Subsequent virtual method calls or field dereferences on the dangling pointer redirect execution to attacker-controlled data. This typically leads to arbitrary code execution inside the reader process.

Root Cause

The root cause is the lack of validation of an object's existence before operations are performed on it. The AcroForm handler assumes the referenced object is live, but attacker-supplied JavaScript or form logic can trigger deallocation before the reference is used. The resulting dangling pointer is dereferenced without a liveness check, matching the pattern described by [CWE-416: Use After Free].

Attack Vector

The attack vector is local and user-assisted. A victim must open a malicious PDF in Foxit PDF Reader or Foxit PDF Editor, or browse to a page that delivers the crafted document to the reader plugin. No authentication is required. Once the file is opened, embedded form logic drives the object lifecycle to reach the vulnerable state and execute code with the privileges of the user running Foxit.

No public proof-of-concept has been released. For deeper technical detail, refer to the Zero Day Initiative Advisory ZDI-24-1296.

Detection Methods for CVE-2024-9243

Indicators of Compromise

Foxit Reader or Editor processes (FoxitPDFReader.exe, FoxitPDFEditor.exe) spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Unexpected outbound network connections initiated by the Foxit process shortly after a PDF is opened.
Crash dumps or Windows Error Reporting events referencing AcroForm modules in the Foxit installation directory.
New files written to %APPDATA%, %TEMP%, or startup locations immediately following PDF viewing activity.

Detection Strategies

Alert on process-lineage anomalies where a PDF reader spawns interpreters, shells, or living-off-the-land binaries.
Monitor for module loads of unusual DLLs into the Foxit process and for memory regions marked executable at runtime.
Correlate email or web-download telemetry showing PDF delivery with subsequent suspicious child-process activity on the same host.

Monitoring Recommendations

Ingest endpoint EDR telemetry that captures process creation, image loads, and file writes into a centralized data lake.
Track Foxit application versions across the fleet and flag hosts still running vulnerable builds.
Review web and mail gateway logs for PDF attachments containing embedded JavaScript or AcroForm actions from untrusted senders.

How to Mitigate CVE-2024-9243

Immediate Actions Required

Update Foxit PDF Reader and Foxit PDF Editor to the latest vendor-released version on all Windows and macOS endpoints.
Inventory installed Foxit builds and prioritize patching for users who routinely handle external PDFs.
Restrict opening of PDFs from untrusted email or web sources until patching is complete.

Patch Information

Foxit has addressed the issue in updated releases of PDF Reader and PDF Editor for Windows and macOS. Consult the Zero Day Initiative Advisory ZDI-24-1296 and the Foxit security bulletins for the specific fixed versions applicable to your deployment.

Workarounds

Disable JavaScript in Foxit under Preferences > JavaScript to reduce the AcroForm attack surface.
Enable Safe Reading Mode to block unverified actions and network activity from documents.
Configure mail and web gateways to strip or sandbox PDFs containing embedded scripts or forms.
Consider an alternate PDF viewer for high-risk workflows until updates are validated.

bash

# Configuration example: query installed Foxit version on Windows
reg query "HKLM\SOFTWARE\Foxit Software\Foxit PDF Reader" /v Version
reg query "HKLM\SOFTWARE\Foxit Software\Foxit PDF Editor" /v Version

# macOS: check installed Foxit application version
defaults read "/Applications/Foxit PDF Reader.app/Contents/Info.plist" CFBundleShortVersionString