CVE-2024-25575

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published
Apr 30, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-255767.9improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to enable escalation of CVE-2024-255787.8MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior contain a lack of proper validation of user-supplied data, which could resultCVE-2024-255796.8OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exeCVE-2024-25588.8A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formexeCommand of the fiCVE-2024-255806.2An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x befCVE-2024-255817.5When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, anCVE-2024-255825.4Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform maliciouCVE-2024-255837.5A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the RecurCVE-2024-255845.3Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to cCVE-2024-25596.5A vulnerability classified as problematic has been found in Tenda AC18 15.03.05.05. Affected is the function fromSysToolReboot of the file /CVE-2024-255907.5An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can leadCVE-2024-255917.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a