CVE-2024-25858 Code injection in n/a

What is CVE-2024-25858?

CVE-2024-25858 is a high-severity code injection vulnerability in Foxit Pdf Editor, published on 5 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to review parameters of commands.

Weakness: CWE-450

Which versions are affected by CVE-2024-25858?

It affects 2 products.

Products include Foxit Pdf Editor, Foxit Pdf Reader.

How do I fix CVE-2024-25858?

No fix has been published for CVE-2024-25858 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-25858 being exploited?

There is no known exploitation of CVE-2024-25858 in the wild and no public exploit code.

Other vulnerabilities in Foxit Pdf Editor

• CVE-2022-28104 File upload in n/a Critical 9.8
• CVE-2022-24954 Memory corruption in n/a Critical 9.8
• CVE-2022-24955 Other in n/a Critical 9.8
• CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation High 8.8
• CVE-2026-91800 Foxit PDF Editor installer local privilege escalation High 8.8

All Foxit Pdf Editor vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-76hh-9ghf-c266.