CVE Feed

    Dashboard / CVE / CVE-2022-24908

    CVE-2022-24908

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16187.

    Published:Mar 28, 2023
    Last Modified:Feb 19, 2025
    EPS:Mar 28, 2023
    EPSS Score:0.02324
    CVSS Score:7.8

    Affected Products

    Vendor
    Foxit
    Product
    Pdf Editor
    Vendor
    Foxit
    Product
    Pdf Reader
    Vendor
    Microsoft
    Product
    Windows

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-18622 (CVSS 4.7) — Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including a…
    CVE-2026-5937 (CVSS 5.5) — Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an u…
    CVE-2026-5938 (CVSS 5.5) — Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the m…
    CVE-2026-5940 (CVSS 7.8) — Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated o…
    CVE-2026-5942 (CVSS 5.5) — Flaws in page lifecycle management allow document structure changes to desynchronize internal component states…
    CVE-2026-5943 (CVSS 7.8) — Document structural anomalies caused inconsistencies between page element relationships and internal index sta…
    CVE-2026-5939 (CVSS 5.5) — A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the applic…
    CVE-2026-5941 (CVSS 7.8) — Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed…
    CVE-2026-3774 (CVSS 4.7) — The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form f…
    CVE-2026-3775 (CVSS 7.8) — The application's update service, when checking for updates, loads certain system libraries from a search path…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High