Foxit PDF Reader CVE-2025-55308

Exploitation requires a victim to open an attacker-crafted PDF in Foxit PDF Reader or PDF Editor for Windows (versions before 13.2, or 2025 before 2025.2) with JavaScript execution enabled, where the PDF's embedded JavaScript calls closeDoc() while internal document objects are still in use. Key limiting factors: it is not remote-automatable - it needs local delivery of the file plus explicit user interaction to open it (UI:R), and the CVSS AC:H reflects a timing/state-dependent use-after-free condition that is not guaranteed to trigger reliably. Environments that disable PDF JavaScript in Foxit's preferences would not be exposed to this JavaScript-driven trigger.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R, base 6.7) describes a difficult-to-exploit, local, user-interaction-dependent flaw - all four exploitability metrics point away from mass exploitation. The EPSS score reinforces this: 0.14% probability at only the 3rd percentile indicates very low expected real-world exploitation activity. There is no CISA KEV listing and no public exploit identified, so the signals are internally consistent: a legitimate memory-corruption bug that is unlikely to be opportunistically weaponized at scale. One notable tension exists: the input CVSS assigns PR:L (requiring some privilege) and C:H/I:H/A:H (full triple-high impact), yet the description says exploitation only requires opening a crafted PDF (no stated privilege) and characterizes the outcome as 'potentially resulting in information disclosure' rather than confirmed code execution or integrity/availability loss - verify impact scope and privilege requirement with the vendor, as the rated impact appears more severe than the described effect. Bottom line: patch in routine cycles; it does not warrant out-of-band response absent new exploitation evidence.

An attacker emails or hosts a crafted PDF containing embedded JavaScript that invokes closeDoc() while internal document objects are still referenced. When a victim opens the file in a vulnerable Foxit PDF Reader/Editor on Windows, the premature object release triggers a use-after-free and memory corruption, potentially leaking memory contents. No public exploit code is identified at time of analysis, and the AV:L/AC:H/UI:R profile means the attack requires local file delivery, user action to open, and winning a non-trivial timing condition.