CVE Feed

    Dashboard / CVE / CVE-2024-12753

    CVE-2024-12753

    Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. By creating a junction, an attacker can abuse the installer process to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25408.

    Published:Dec 30, 2024
    Last Modified:Aug 8, 2025
    EPS:Dec 30, 2024
    EPSS Score:0.00015
    CVSS Score:7.3

    Affected Products

    Vendor
    Foxit
    Product
    Pdf Editor
    Vendor
    Foxit
    Product
    Pdf Reader
    Vendor
    Microsoft
    Product
    Windows

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-18622 (CVSS 4.7) — Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including a…
    CVE-2026-5937 (CVSS 5.5) — Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an u…
    CVE-2026-5938 (CVSS 5.5) — Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the m…
    CVE-2026-5940 (CVSS 7.8) — Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated o…
    CVE-2026-5942 (CVSS 5.5) — Flaws in page lifecycle management allow document structure changes to desynchronize internal component states…
    CVE-2026-5943 (CVSS 7.8) — Document structural anomalies caused inconsistencies between page element relationships and internal index sta…
    CVE-2026-5939 (CVSS 5.5) — A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the applic…
    CVE-2026-5941 (CVSS 7.8) — Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed…
    CVE-2026-3774 (CVSS 4.7) — The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form f…
    CVE-2026-3775 (CVSS 7.8) — The application's update service, when checking for updates, loads certain system libraries from a search path…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High