Foxit PDF Reader
CVE-2025-55307
LOW
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious PDF to victim
-
DeliveryVictim opens file in Foxit
-
ExploitJavaScript invokes search.query() with crafted cDIPath
-
ExecutionOOB read in path parser
-
ImpactLeak adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied PDF in Foxit PDF Reader or PDF Editor for Windows (versions before 13.2, or 2025 builds before 2025.2) with JavaScript execution enabled, where the embedded script calls search.query() with a crafted cDIPath parameter such as '/'. Limiting factors: this is a local file-open attack (AV:L) that mandatorily requires user interaction (UI:R) - there is no remote or network-triggered path - and it depends on Foxit's JavaScript engine being active (disabling PDF JavaScript neutralizes it). Impact is confined to low-confidentiality information disclosure; privileged access is not required of the attacker. |
| Impact | This is a genuinely low-priority issue despite the memory-corruption language in the description. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.3) correctly models a local, user-interaction-dependent file-open attack: the victim must open a malicious PDF, and the only confirmed impact is low confidentiality (an out-of-bounds READ, CWE-125), with no integrity or availability impact scored. All exploitation signals agree on low risk: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced. The one point of tension is the description's phrase 'potentially leading to information disclosure or memory corruption' - 'memory corruption' hints at possible integrity/availability impact beyond the C:L-only scoring, but this is speculative vendor wording for an OOB READ and is not reflected in the assigned vector; treat the I:N/A:N scoring as authoritative unless Foxit publishes otherwise. No SSVC decision data was provided. Net: a real but minor bug suitable for routine patch cycles, not emergency response. |
| Exploit ScenarioDerived | An attacker crafts a PDF embedding a JavaScript call to search.query() with a malformed cDIPath parameter (e.g., '/') and delivers it via email or a download link. When a victim opens the file in a vulnerable Foxit PDF Reader/Editor build, the internal path parser reads out of bounds, potentially leaking adjacent memory contents back to the attacker-controlled script. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in Foxit PDF Reader and PDF Editor for Windows (versions before 13.2, and 2025 builds before 2025.2) is reachable when a victim opens an attacker-supplied PDF whose embedded JavaScript calls search.query() with a crafted cDIPath parameter such as '/'. Exploitation is strictly local and requires the user to open the malicious file with Foxit's JavaScript engine enabled, and the assessed impact is limited to low-confidentiality information disclosure rather than code execution. There is no public exploit identified at time of analysis; CISA KEV does not list this CVE and EPSS is only 0.18% (7th percentile), consistent with a low-priority finding.
RemediationAI
Upgrade Foxit PDF Reader and Foxit PDF Editor for Windows to version 13.2 or 2025.2 (or later), as these are the vendor-released fixed versions listed in the advisory at https://www.foxit.com/support/security-bulletins.html. Where immediate upgrading is not possible, disable JavaScript execution in Foxit (File > Preferences > JavaScript, uncheck 'Enable JavaScript Actions'), which removes the search.query()/cDIPath trigger entirely - the trade-off is that interactive PDFs, forms, and calculations relying on JavaScript will stop working. Additional hardening with minimal side effects includes treating untrusted PDFs as risky attachments and opening them in a sandboxed viewer, and avoiding PDFs from unverified sources; these controls do not fix the underlying defect and remain necessary only until the patch is applied. Because exploitation is local and requires the user to open the file, no network-level mitigation such as port blocking applies.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an out-of-bounds read (CWE-125) inside the internal path-parsing logic that handles the cDIPath argument passed to the PDF JavaScript API search.query(). Affected components are Foxit PDF Reader and Foxit PDF Editor for Windows, identified in CPE data as cpe:2.3:a:foxit:pdf_editor (including the specific build 2025.1.0.27937) and cpe:2.3:a:foxit:pdf_reader. The root cause is insufficient bounds validation when the parser resolves a directory/path string, so a specially crafted value causes the parser to read past the end of an allocated buffer; this is a read primitive, so the realistic consequence is memory-content disclosure, with memory corruption only a secondary possibility. Because the attack is delivered through a PDF opened locally by the user, the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - no network vector, no attacker privileges required, but mandatory user interaction, and it is fully dependent on Foxit's JavaScript execution being active.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local file-open attack needing no attacker privileges but mandatory victim interaction (UI:R); an OOB read yields only low confidentiality impact, so I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
GitHub PoC
Exploit-DB