According to Foxit's March 5, 2024 security bulletin, affected Windows versions included Foxit PDF Reader 2023.3.0.23028 and earlier, and multiple Foxit PDF Editor release lines up to the versions listed in the bulletin.

Technical Summary

PDF annotations are represented as dictionaries attached to pages through the page's /Annots array. A reader needs to parse the annotation dictionary, resolve direct and indirect values, normalize geometry and appearance data, and bridge the result into rendering, selection, editing, JavaScript, and accessibility paths.

The bug class for CVE-2024-30350 is a boundary validation failure in that annotation parsing pipeline. A malformed annotation object could cause Foxit PDF Reader to trust a derived length or object shape that no longer matched the backing buffer. Under the vulnerable path, the program could read past the allocated object boundary. The observed failure mode was an access violation during annotation handling; with memory arranged differently, the same primitive could expose adjacent process memory.

The issue was not a one-click network vulnerability. The attacker needed to convince the target user to open a crafted document or reach a delivery page that caused the document to be opened. That is reflected in the CVSS user-interaction requirement.

Discovery Story

The original investigation began as a focused audit of complex PDF object families rather than as a general file-format fuzzing run. Annotation handling was selected because annotations sit at a dense intersection of parser logic, UI behavior, JavaScript exposure, and incremental document updates.

The early corpus mixed ordinary documents with synthetic pages containing high-variance annotation dictionaries. The generator varied array lengths, object indirection, null values, unexpected primitive types, recursive references, and appearance stream combinations. The most useful samples were not fully random. They were grammar-aware enough to reach annotation normalization code, but still malformed enough to test assumptions in the native parser.

The first signal was a crash that reproduced only when a page contained a specific malformed annotation structure and the annotation was forced through the interactive handling path. Opening the document was enough to parse the page, but reliable reproduction improved when the view was refreshed, the page was zoomed, or the annotation tree was touched by selection or rendering code.

Debugging narrowed the issue to a read past the end of a heap allocation during annotation object processing. The crash did not resemble a null dereference. The failing instruction consumed memory adjacent to an annotation-related buffer, and the size relationships in the minimized sample suggested a mismatch between a parsed logical count and the real storage available for that object.

The sample was minimized by repeatedly removing unrelated PDF objects, page resources, fonts, metadata, and streams until only the page tree, the target page, and the annotation structure remained. The reduced file preserved the same crash signature, which made it suitable for coordinated disclosure.

After triage, the finding was submitted through Zero Day Initiative. The vendor report date in the public advisory is 2023-12-20. The coordinated advisory was published on 2024-03-28, and Foxit addressed the issue in the 2024.1 update line.

Impact

The direct impact is disclosure of memory from the Foxit PDF Reader process. In isolation, that usually means limited confidentiality impact. In a more complete exploit chain, however, an out-of-bounds read can be valuable for leaking heap contents, object pointers, allocation layout, or other process state needed to make a separate memory corruption vulnerability reliable.

This explains the low standalone CVSS score while still making the issue meaningful for exploit chain hardening.

Defensive Notes

Users should update Foxit PDF Reader and Foxit PDF Editor to fixed versions. Organizations that handle untrusted PDFs should also keep Protected View, Safe Reading Mode, file reputation controls, attachment filtering, and endpoint exploit mitigations enabled.

For parser developers, the main lesson is that annotation dictionaries should be treated as untrusted structured input even when the surrounding PDF is syntactically valid. Derived lengths, normalized arrays, resolved indirect objects, and cached object representations should be validated at every boundary between parser, renderer, scripting, and UI code.

Repository Contents

References

• https://www.zerodayinitiative.com/advisories/ZDI-24-333/
• https://www.cve.org/CVERecord?id=CVE-2024-30350
• https://nvd.nist.gov/vuln/detail/CVE-2024-30350
• https://www.foxit.com/support/security-bulletins.html