CVE-2024-9254: Foxit PDF Editor Use-After-Free RCE Flaw

CVE-2024-9254 Overview

CVE-2024-9254 is a use-after-free vulnerability [CWE-416] in Foxit PDF Reader and Foxit PDF Editor that enables remote code execution. The flaw resides in the handling of Annotation objects, where the application performs operations on objects without first validating their existence. Attackers can trigger the condition by convincing a user to open a crafted PDF file or visit a malicious page that loads such a file. Successful exploitation results in arbitrary code execution in the context of the current process. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25173 and tracked publicly as ZDI-24-1307.

Critical Impact
Remote attackers can execute arbitrary code on Windows and macOS systems running affected Foxit PDF Reader or Foxit PDF Editor versions when a user opens a malicious PDF.

Affected Products

Foxit PDF Reader (Windows and macOS)
Foxit PDF Editor (Windows and macOS)
Versions prior to the fixed builds documented in the Foxit security bulletins

Discovery Timeline

2024-11-22 - CVE-2024-9254 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9254

Vulnerability Analysis

The vulnerability is a use-after-free condition in the annotation handling subsystem of Foxit PDF Reader and Editor. The application operates on Annotation objects without confirming they still exist in memory. When a referenced object has been freed but its pointer is still used, the dangling pointer allows attackers to influence the contents of the reclaimed memory region. By spraying controlled data into the freed allocation, an attacker can hijack control flow when the application dereferences the stale pointer. The result is arbitrary code execution within the rendering process, inheriting the privileges of the current user.

Root Cause

The root cause is missing object lifetime validation prior to use. The annotation handler does not verify that the underlying object reference remains valid after operations that can invalidate it, such as deletion or replacement during JavaScript-driven document manipulation. This is a classic [CWE-416] Use After Free pattern in PDF readers, often introduced when annotation properties can be mutated through embedded scripting while object references are cached.

Attack Vector

Exploitation requires user interaction. The victim must open a malicious PDF in Foxit PDF Reader or Editor, or visit a web page that renders a crafted PDF through the Foxit browser plugin. The attack does not require authentication or elevated privileges. Because user interaction is the only barrier, phishing and drive-by download chains are the most practical delivery methods.

No verified public exploit code is available for this issue. Refer to the ZDI Advisory ZDI-24-1307 for the disclosure summary and the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2024-9254

Indicators of Compromise

Foxit PDF Reader or Editor processes (FoxitPDFReader.exe, FoxitPDFEditor.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Crashes in Foxit processes referencing annotation handling routines in Windows Error Reporting or macOS crash logs
PDF files containing unusual JavaScript that programmatically creates, deletes, and re-references annotation objects
Outbound network connections initiated by a Foxit process shortly after a PDF is opened

Detection Strategies

Monitor for process lineage anomalies where Foxit binaries launch shell, scripting, or LOLBin processes
Inspect inbound PDF attachments and downloads for embedded JavaScript that manipulates Annotation objects through addAnnot, removeAnnot, or similar APIs
Correlate Foxit process crashes with subsequent suspicious activity on the same host
Use YARA rules targeting PDF structures with high-density annotation manipulation and heap-spray style JavaScript

Monitoring Recommendations

Enable command-line and process-creation logging on endpoints that handle PDFs
Forward Foxit application logs and OS crash telemetry to a centralized analytics platform for correlation
Track Foxit version inventory across the fleet to identify hosts still running vulnerable builds
Alert on PDF files sourced from external email or web origins that trigger Foxit child-process activity within seconds of being opened

How to Mitigate CVE-2024-9254

Immediate Actions Required

Update Foxit PDF Reader and Foxit PDF Editor to the latest fixed versions listed in the vendor security bulletin
Inventory all installations, including portable and per-user installs that may bypass centralized patching
Restrict execution of PDFs from untrusted sources via email gateway and web proxy controls
Brief users on the risk of opening unexpected PDF attachments until patching is complete

Patch Information

Foxit has published fixes in updated builds of Foxit PDF Reader and Foxit PDF Editor for both Windows and macOS. Consult the Foxit Security Bulletins for the exact fixed versions and download links. The corresponding ZDI advisory is available at ZDI Advisory ZDI-24-1307.

Workarounds

Disable JavaScript in Foxit PDF Reader and Editor via Preferences > JavaScript > Enable JavaScript Actions to reduce the attack surface for annotation manipulation
Configure Safe Reading Mode to block unsafe operations on documents from untrusted locations
Use an alternative hardened PDF viewer for files originating from untrusted sources until patching is verified
Block the Foxit browser plugin in managed browsers to prevent drive-by exploitation through web-delivered PDFs

bash

# Example: Windows registry change to disable JavaScript in Foxit PDF Reader
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f