CVE Feed

    Dashboard / CVE / CVE-2023-33240

    CVE-2023-33240

    Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous 11.x versions, and 10.1.11.37866 and earlier) on Windows allows Local Privilege Escalation when installed to a non-default directory because unprivileged users have access to an executable file of a system service. This is fixed in 12.1.2.

    Published:May 19, 2023
    Last Modified:Jan 21, 2025
    EPS:May 19, 2023
    EPSS Score:0.00044
    CVSS Score:7.8

    Affected Products

    Vendor
    Foxit
    Product
    Pdf Editor
    Vendor
    Foxit
    Product
    Pdf Reader
    Vendor
    Microsoft
    Product
    Windows

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-276 Incorrect Default Permissions

    Related CVEs

    CVE-2026-18622 (CVSS 4.7) — Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including a…
    CVE-2026-5937 (CVSS 5.5) — Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an u…
    CVE-2026-5938 (CVSS 5.5) — Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the m…
    CVE-2026-5940 (CVSS 7.8) — Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated o…
    CVE-2026-5942 (CVSS 5.5) — Flaws in page lifecycle management allow document structure changes to desynchronize internal component states…
    CVE-2026-5943 (CVSS 7.8) — Document structural anomalies caused inconsistencies between page element relationships and internal index sta…
    CVE-2026-5939 (CVSS 5.5) — A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the applic…
    CVE-2026-5941 (CVSS 7.8) — Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed…
    CVE-2026-3774 (CVSS 4.7) — The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form f…
    CVE-2026-3775 (CVSS 7.8) — The application's update service, when checking for updates, loads certain system libraries from a search path…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High