CVE-2022-24955
Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
Affects 3 products across 2 vendors.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
Foxit PDF Reader and Foxit PDF Editor versions prior to 11.2.1 are vulnerable to an Uncontrolled Search Path Element for DLL files, which could allow an attacker to execute arbitrary code if a malicious DLL is placed in a specific directory.
BSID: BS-2022-GLOBAL-070563-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2022-24955?
What is the CVSS score for CVE-2022-24955?
Is CVE-2022-24955 actively exploited?
How do I remediate CVE-2022-24955?
What systems are affected by CVE-2022-24955?
| CVE ID | CVE-2022-24955 |
|---|---|
| BSID | BS-2022-GLOBAL-070563-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2022-02-11 |
| Last Modified | 2024-11-21 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
Source: NIST NVD / MITRE CVE Database
An attacker can exploit this vulnerability by placing a malicious DLL in a directory that is searched before the legitimate DLL path. When the vulnerable application is executed, it may load the malicious DLL, leading to arbitrary code execution with the privileges of the user running the application.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Foxit | Pdf Reader | ≤ 11.1.0.52543 |
| Foxit | Pdf Editor | ≤ 10.1.6.37749 ≥ 11.0.1.0719, ≤ 11.2.0.53415 |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Microsoft Windows
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 74994231f4c053b181899477cbb3c8c15772d76bfa0205102b4ab52de442655ec62d0c3aeb3a56cad153891dc783b4d2bc21ae908f4f04cbdc4b5b7b737d0322 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →