CVE-2023-42089 is an information disclosure flaw in Foxit PDF Reader: a use after free in the handling of templates. NVD scores it 7.8 (High), while the Zero Day Initiative advisory scores it 3.3 (Low). Foxit says it has issued an update. Check Foxit's bulletin for the fixed version.
What's affected
Both the NVD record and ZDI-23-1422 name Foxit PDF Reader. The NVD configuration lists Foxit PDF Editor entries as well. Neither source we read gives an affected or fixed version number. ZDI-23-1422 says only that Foxit "has issued an update to correct this vulnerability" and points to Foxit's security bulletins page.
We tried the Foxit bulletin page and could not locate a 2023 entry for this CVE in the portion we could read, so no version is stated here. Look for the entry on Foxit's bulletin page before you decide on a target version.
The two scores
This is a source conflict worth knowing about. The NVD record gives CVSS 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The ZDI advisory gives 3.3 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
The difference is the impact rating. NVD scores confidentiality, integrity and availability impact as high or partly high. ZDI scores only a low confidentiality impact, which fits the description: the bug discloses information and the attacker "can leverage this in conjunction with other vulnerabilities to execute arbitrary code." Plan with the higher score if you triage by NVD, and keep the lower one in mind when you compare it with other issues in the same release.
How to check if you're exposed
Open Foxit PDF Reader, go to Help, then About, and note the version. On Windows you can also read it from the installed programs list:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*Foxit*" } |
Select-Object DisplayName, DisplayVersion
Compare the result with the fixed version in Foxit's bulletin. A user has to open a malicious file or visit a malicious page, so the exposure is higher where staff open PDFs from outside the company.
What to do now
- Find every machine with Foxit PDF Reader or Editor installed.
- Open Foxit's security bulletin page and find the release that covers CVE-2023-42089.
- Update to that release or a later one.
- Turn off automatic opening of PDFs from email previews where you can.
- Remind staff to treat unexpected PDF attachments with caution.
Why it matters
The advisory says the issue results from the lack of validating the existence of an object prior to performing operations on it. Reading or freeing memory incorrectly in a document parser can reveal what is in memory. On its own that is an information leak. Attackers value leaks because they help defeat protections that rely on addresses being unpredictable, which is why the advisory language about combining it with other flaws matters.
User interaction is required, and the vector is local. The KEV flag in the record is false. PDF readers are on nearly every desktop, so a modest bug here can still touch a lot of machines.
Desktop software is not in your repository manifests, so track it with endpoint inventory. For applications you build, the free dependency scan covers libraries, and the weakness class page for CWE-416 lists related records.
Quick check
Is this being exploited?
The record's KEV flag is false and neither source we read says it is exploited. Check CISA's catalog if that matters for your policy.
Which score should I use?
Both are published. NVD says 7.8 and ZDI says 3.3. Use the higher figure for conservative triage and the advisory text to understand the real impact: information disclosure that helps other attacks.
Sources
- ZDI-23-1422 advisory
- Foxit security bulletins (no 2023 entry for this CVE found in the part we could read)
- NVD record for CVE-2023-42089
Last reviewed: 19 October 2026.
