CVE-2021-34847

What it actually does

CVE-2021-34847 is a memory-safety vulnerability in Foxit PDF Reader 11.0.0.49893, and potentially related Foxit PDF Editor builds, in the handling of PDF Annotation objects. The flaw is caused by failing to validate that an object still exists before operating on it, resulting in a use-after-free condition. If an attacker can convince a user to open a malicious PDF or visit a malicious web page that causes Foxit to process attacker-controlled PDF content, the attacker may achieve arbitrary code execution in the context of the Foxit process and the signed-in user. Successful exploitation can allow theft of local files accessible to that user, malware installation, command execution, persistence setup, or lateral movement using the user’s privileges.

Why it matters to the business

A successful exploit can turn a routine PDF-opening action into a full workstation compromise. This is operationally significant because PDF readers are widely used for business documents, invoices, forms, contracts, and email attachments, making phishing or document-based delivery realistic. Although the vulnerability is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the EPSS score is high, meaning exploitation likelihood should be treated as meaningful. Organizations using affected Foxit versions face risk of endpoint compromise, credential theft, data exfiltration, malware deployment, and disruption of user workstations.

How an attack unfolds

An attacker crafts a malicious PDF or web-delivered document that contains specially structured Annotation objects designed to trigger the use-after-free condition in Foxit’s parsing or rendering logic. The attacker then delivers the content through phishing email, a compromised website, a file-sharing link, instant messaging, or another social-engineering path. When the user opens the document or previews content in an affected Foxit application, Foxit mishandles the Annotation object lifecycle and performs operations on an invalid object. With successful memory manipulation, the attacker redirects execution flow and runs payload code inside the Foxit process. The payload typically attempts to escape the document-reader context by launching a child process, dropping a file, connecting to attacker infrastructure, downloading additional malware, or executing commands with the privileges of the current user.

How to fix it

Upgrade Foxit PDF Reader and Foxit PDF Editor to a vendor-supported version that is newer than Foxit PDF Reader 11.0.0.49893 and includes the security fix for this vulnerability. Because no exact fixed versions were provided in the input, validate remediation against Foxit’s official security advisories and release notes for CVE-2021-34847 before closing the issue. Remove unsupported or legacy Foxit installations where upgrade is not possible. As mitigations, restrict opening of untrusted PDFs, disable browser-based PDF handling by vulnerable Foxit components where applicable, enforce email attachment sandboxing, use endpoint protection capable of blocking suspicious child processes from document readers, and apply application control rules to prevent Foxit from launching scripting engines, shells, or unsigned executables.

How to confirm the fix worked

Confirm exposure by inventorying installed Foxit PDF Reader and Foxit PDF Editor versions across endpoints and identifying Foxit PDF Reader 11.0.0.49893 or any vendor-confirmed affected related builds. Validate remediation by confirming the installed version is a vendor-supported patched release and that vulnerable legacy binaries are no longer present. On Windows endpoints, check installed application inventory, Add/Remove Programs entries, software management tooling, and file metadata for Foxit executables. Security teams can also validate mitigations by confirming EDR or application-control policy blocks suspicious child-process creation from Foxit processes, such as launching cmd.exe, powershell.exe, wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or curl-like download utilities.

Typical attack path

1. Identify users or organizations likely to open PDF attachments or web-hosted PDF content.
2. Craft a malicious PDF containing malformed Annotation objects that trigger the Foxit use-after-free condition.
3. Deliver the PDF through phishing email, document-sharing services, compromised websites, or messaging platforms.
4. Wait for a user to open the PDF or browse to the malicious page using an affected Foxit application.
5. Exploit memory corruption to execute attacker-controlled code in the Foxit process.
6. Launch a payload such as a command shell, script interpreter, downloader, credential stealer, or remote access tool.
7. Establish persistence, exfiltrate data, or move laterally using the compromised user context.

How to detect it

To determine whether this vulnerability was already exploited, focus on endpoint, email, web proxy, and file telemetry around PDF-opening events. Review EDR process trees where FoxitPDFReader.exe, FoxitReader.exe, FoxitPhantomPDF.exe, or FoxitPDFEditor.exe launched unexpected child processes such as command shells, PowerShell, script hosts, rundll32, regsvr32, mshta, or download tools. Look for Foxit crashes followed closely by new process execution, file creation in user-writable directories, persistence changes, or outbound network connections. Examine email-security and web-proxy logs for suspicious PDF attachments or downloads immediately preceding endpoint alerts. On affected hosts, collect Windows Event Logs, EDR telemetry, prefetch files, Amcache/Shimcache, browser downloads, recent files, temporary directories, and the user’s Downloads/Desktop locations. Investigate any malicious or unusual PDFs containing complex or malformed Annotation structures, especially if opened shortly before suspicious process execution. There are no universal file hashes or network indicators for this vulnerability; detection should rely primarily on exploit behavior and post-exploitation activity.

• FoxitPDFReader.exe -> cmd.exe
• FoxitPDFReader.exe -> powershell.exe
• FoxitPDFReader.exe -> wscript.exe
• FoxitPDFReader.exe -> cscript.exe
• FoxitPDFReader.exe -> mshta.exe
• FoxitPDFReader.exe -> rundll32.exe
• FoxitPDFReader.exe -> regsvr32.exe
• FoxitPDFReader.exe -> certutil.exe
• FoxitPDFReader.exe -> bitsadmin.exe
• FoxitPDFReader.exe -> curl.exe
• FoxitPDFReader.exe -> wget.exe
• FoxitReader.exe -> cmd.exe
• FoxitReader.exe -> powershell.exe
• FoxitReader.exe -> wscript.exe
• FoxitReader.exe -> mshta.exe
• FoxitPhantomPDF.exe -> cmd.exe
• FoxitPhantomPDF.exe -> powershell.exe
• FoxitPDFEditor.exe -> cmd.exe
• FoxitPDFEditor.exe -> powershell.exe
• ProcessName=FoxitPDFReader.exe AND EventType=NetworkConnection
• ProcessName=FoxitReader.exe AND EventType=NetworkConnection
• ProcessName=FoxitPDFEditor.exe AND EventType=NetworkConnection
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk
• %TEMP%\*.exe
• %APPDATA%\*.exe
• %LOCALAPPDATA%\Temp\*.exe

What your security team should do

• Prioritize upgrading or removing Foxit PDF Reader 11.0.0.49893 and any affected Foxit PDF Editor builds, especially on endpoints used for email, finance, legal, HR, procurement, or other document-heavy workflows.
• Use software inventory or endpoint management tooling to identify all Foxit installations and verify patched versions against Foxit’s official advisory for CVE-2021-34847.
• Hunt for suspicious Foxit process behavior, especially Foxit spawning command interpreters, scripting engines, LOLBins, download utilities, archive tools, or unknown executables.
• Add EDR prevention or application-control rules that block document-reader processes from launching child processes unless explicitly required.
• Increase scrutiny of inbound PDFs from email, file-sharing platforms, and external collaboration portals using attachment detonation or sandboxing.
• Review proxy, DNS, and EDR telemetry for network connections initiated by Foxit processes, particularly to newly registered, uncategorized, or rare external domains.
• Educate users that unexpected PDF attachments or links can compromise their workstation even if the document appears blank, malformed, or crashes the reader.
• If suspicious activity is found, isolate the endpoint, preserve forensic artifacts, collect the malicious PDF if available, and review user-context credential exposure.