Acrobat out-of-bounds and Foxit use-after-free PDF reader vulnerabilities found
Summary: Cisco Talos disclosed three out-of-bounds read vulnerabilities in Adobe Acrobat Reader, tracked as CVE-2024-49534, CVE-2024-49533, and CVE-2024-49532, triggered by specially crafted font files embedded in a PDF. It also disclosed two use-after-free vulnerabilities in Foxit Reader, CVE-2024-49576 and CVE-2024-47810, triggered by malicious JavaScript in a PDF or by visiting a malicious website with the Foxit browser extension enabled. Adobe patched in version 24.005.20320 and Foxit in PDF Editor version 12.1.9/11.2.12.
What you should know: The Foxit flaws can lead to memory corruption and arbitrary code execution, and the Acrobat out-of-bounds reads can disclose sensitive information and enable further exploitation - both reachable by tricking a user into opening a file or, for Foxit, simply browsing to a malicious site with the extension on.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-47810CVE-2024-49532CVE-2024-49533CVE-2024-49534CVE-2024-49576
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026