Foxit PDF Editor CVE-2025-55310

Exploitation requires the attacker to first have local write access to the static HTML files used by Foxit's StartPage feature (the files are loaded without an integrity check - CWE-494). After tampering, the victim must launch Foxit PDF Reader or Editor for the malicious startup content to load (UI:R). Limiting factors: this is NOT remotely exploitable (AV:L) - the attacker needs a pre-existing local presence and file-write permission to the StartPage assets; the actual privilege level hinges on where those HTML files live (user profile vs. protected install directory). Affected scope is Foxit PDF and Editor for Windows and macOS before 13.2, and 2025 builds before 2025.2.

This is a moderate-severity, low-urgency issue despite the 7.3 CVSS base score. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R) is the dominant signal and it tells a limited story: exploitation is LOCAL (AV:L), requires an existing low-privilege foothold (PR:L), and depends on the victim launching the application (UI:R). This is a classic CWE-494 (code/content download without integrity verification) weakness, not a remotely exploitable RCE. All real-world exploitation signals point low: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified. These signals are mutually consistent - nothing here conflicts, which is itself reassuring. The one point of tension is the impact triple C:H/I:H/A:H assigned by NVD, which appears generous relative to the description, which only enumerates 'information disclosure, unauthorized data access, or other security impacts' and does not clearly establish high integrity or availability loss. Net: this is a high-CVSS-but-low-real-risk issue in practice - it is a local tampering/persistence primitive that presupposes an attacker already has code execution or file-write on the host, rather than a priority patch-now vulnerability. Treat it as defense-in-depth hardening, not an incident driver.

An attacker who already has a local low-privilege foothold (e.g., resident malware or a non-admin user) modifies or replaces the static HTML files that Foxit's StartPage feature renders on launch. The next time the victim opens Foxit PDF Reader or Editor, the application loads the attacker-controlled content without integrity checking, enabling information disclosure or unauthorized data access. No public exploit code has been identified, so this would require custom tooling.