Wednesday, May 21, 2025
HomeCVE/vulnerabilityFoxit Reader Vulnerability Let Hackers Run Malicious Code via PDFs

Foxit Reader Vulnerability Let Hackers Run Malicious Code via PDFs

Published on

SIEM as a Service

Follow Us on Google News

Aleksander Nikolic, the security expert of Cisco Talos has recently detected a vulnerability that is continuously targeting the “Foxit Reader.”

However, Foxit has already published an update, so that they can close this severe vulnerability which is allowing attackers to exploit the PDFs to run malicious code remotely.  

The security experts have detected many security holes, but they are still investigating the whole matter. The specialists have named the vulnerability “CVE-2021-21822,” and they are still trying to find out the key details of this vulnerability.

- Advertisement - Google News

This vulnerability is one of the high severity remote code execution, and it has been allowing the threat actors to implement malicious code on a user’s Windows computer remotely so that they can take control over the device.

After digging more about this vulnerability the analysts found that 650 million users from nearly 200 countries are currently using its reader.

Not only this but the list also includes large enterprise customers like Google, Intel, NASDAQ, Dell, Chevron, Asus, British Airways, HP, and Lenovo.

Flaw profile

  • CVE: CVE-2021-21822
  • CWE: CWE-416 – Use After Free
  • CVSS: 8.8
  • Severity: Critical

Users Exposed to RCE Attacks Due to’Use After Free’ Bug

The cybersecurity analyst, Aleksander Nikolic from Cisco Talos has detected this severe flaw through the “Use After Free” bug. 

Nikolic found this flaw in the V8 JavaScript engine, and this V8 engine is used by Foxit Reader to display the dynamic forms and communicative document elements.

Due to the improper handling of annotations by the Foxit Reader application and its browser extension this type of vulnerability occurs. And here the attacker takes the advantage of these annotations to craft malicious PDFs, that are later used to run an arbitrary code on the device.

More Bugs Were Fixed

This is not the first time when Foxit Reader gets attacked, as there are various other security bugs that are continuously attacking the former version of the  Foxit Reader.

All the security bugs were revealing users’ devices to the denial services, information disclosure, DLL hijacking, remote code execution, SQL injection, and many other security bugs.

Here are the security fixes that Foxit Reader has fixed in its 10.1.4 version:-

  • Memory Corruption vulnerability
  • Denial of Service vulnerability
  • Null Pointer Reference, Out-of-Bounds Read, Context Level Bypass, Type Confusion, or Buffer Overflow vulnerability 
  • Arbitrary File Deletion vulnerability
  • Deliver incorrect signature information
  • DLL Hijacking vulnerability
  • Read Remote Code Execution vulnerability
  • Information Disclosure vulnerability
  • Out-of-Bounds Write vulnerability
  • Arbitrary File Write Remote Code Execution vulnerability
  • SQL Injection Remote Code Execution vulnerability
  • Uninitialized Variable Information Disclosure vulnerability
  • Heap-based Buffer Overflow vulnerability

Recommendation

Apart from all these things, this vulnerability class the Foxit Reader 10.1.3.37598 as well as its former versions as well. And according to the report, it was being addressed with the release of Foxit Reader 10.1.4.37651.

However, the researchers have strongly recommended the users of Foxit Reader to immediately update their software with the new version. And to do so, you have to follow the simple steps that we have mentioned below:-

  • First, you have to open the app.
  • Then click on the “Check for Updates” in the app’s “Help” dialog.
  • That’s it, your update procedure will start.

So, following or implementing the above steps will provide greater security and consequently, the users will be able to keep themselves safe and secure from this kind of security bug.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

PowerDNS Vulnerability Allows Attackers to Trigger DoS Attacks Through Malicious TCP Connections

PowerDNS has released a critical security update to address a vulnerability in its DNSdist...

VanHelsing Ransomware Builder Exposed on Hacker Forums

The cybersecurity landscape reveal that the VanHelsing ransomware operation has experienced a significant security...

IBM Warns: One-Third of Cyber Attacks Use Advanced Tactics to Steal Login Credentials

IBM X-Force's 2024 cybersecurity report, nearly one-third of cyber intrusions now rely on identity-based...

19-Year-Old Hacker Admits Guilt in Major Cyberattack on PowerSchool

Massachusetts college student stands accused of orchestrating a sweeping cyberattack on PowerSchool, a widely...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in...

Cisco IOS XE Vulnerability Allows Attackers to Gain Elevated Privileges

Cisco has issued an urgent security advisory (ID: cisco-sa-iosxe-privesc-su7scvdp) following the discovery of multiple...

Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots

 Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in...