Foxit PDF Reader CVE-2025-55309

Exploitation requires the victim to open an attacker-crafted PDF that contains JavaScript attaching an OnBlur action (destroying an annotation) to a form field, AND to perform a right-click interaction on that form field - it is the right-click-driven internal focus change that prematurely releases the annotation and triggers the use-after-free. JavaScript execution in the PDF must be enabled (default in Foxit), and the application must be a vulnerable version (Reader/Editor before 13.2, or 2025 before 2025.2 on Windows or macOS). Limiting factors that reduce real-world risk: the vector is local (the file must reach and be opened by the user, AV:L), it demands specific user interaction beyond mere opening (the targeted right-click, UI:R), and the use-after-free is a timing/focus-handling race giving high attack complexity (AC:H), so reliable exploitation is not guaranteed.

This is a genuine but moderate-priority client-side vulnerability rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R, base 6.7) already caps real-world risk heavily: exploitation is NOT remote-network (AV:L - the malicious PDF must be delivered and opened locally), attack complexity is HIGH (the use-after-free depends on a specific race during focus-change handling triggered by an OnBlur action), and it requires user interaction (UI:R - the victim must open the file and perform a right-click on the form field). SSVC-style reading: exploitation is NOT automatable (it needs per-victim social engineering and a non-trivial timing window), and technical impact is total for the single process (C:H/I:H/A:H, S:U - contained to the application). The exploitation signals reinforce low urgency: EPSS is 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and there is no public exploit identified at time of analysis. These signals are consistent with one another - low EPSS, no KEV, no POC, and a high-complexity local vector all point the same direction. Note a mild tension worth verifying: the CVSS impact triad is C:H/I:H/A:H (implying code execution / full compromise), yet the description itself only commits to 'memory corruption or application crashes,' so reliable arbitrary code execution is plausible for a UAF but not confirmed by the vendor text - treat C:H/I:H as the worst-case ceiling, with availability impact being the confirmed outcome. Overall: patch in normal cycle; this is a high-CVSS-impact-but-constrained-reachability issue, not a drop-everything threat.

An attacker emails or hosts a crafted PDF containing JavaScript that attaches an OnBlur action to a form field which destroys an annotation. The victim opens the document in a vulnerable Foxit PDF Reader/Editor and right-clicks the form field; the resulting focus change prematurely frees the annotation object, triggering a use-after-free that corrupts memory and can crash the application or potentially lead to code execution. No public exploit code is known, and the attack requires the specific right-click interaction plus a successful timing/heap condition (AC:H, UI:R).