Foxit PDF Editor CVE-2025-55311

Exploitation requires the victim to open an attacker-crafted PDF in an affected Foxit PDF Reader or Editor (Windows/macOS before 13.2, or 2025 before 2025.2) and to rely on that client's signature-validation indication. The attack specifically abuses Foxit's JavaScript interfaces that can modify annotation content and then clear the file's modification status, so the malicious document must contain such JavaScript and be digitally signed to make the forgery meaningful. Limiting factors: user interaction is mandatory (UI:R) - the file must be opened and its signature trusted; there is no server-side or unauthenticated-service exposure, no code execution, and no automated/wormable vector. Impact is confined to deceiving users about signed-document integrity.

This is a genuine but moderate-priority integrity issue, not a code-execution emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N = 6.5) is internally consistent with the description: no confidentiality or availability impact, but a high integrity impact stemming from digital-signature verification bypass (CWE-347). All exploitation signals point AWAY from urgency: EPSS is 0.20% (10th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified in the provided data, so the status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The one meaningful caveat is that AV:N here reflects network DELIVERY of a malicious file rather than a remotely reachable service - actual exploitation still depends on UI:R (a victim opening the crafted PDF and trusting its signature), which materially limits mass exploitation. This is therefore a real but targeted-use concern (e.g., forged contracts/attestations) rather than a widespread, automatable threat; prioritize patching where signed-PDF trust is security-relevant, but it does not warrant emergency response.

An attacker crafts a signed PDF whose embedded JavaScript alters annotation content and then clears the document's modification flag, so a vulnerable Foxit client still displays the signature as valid despite post-signing changes. A victim opens the document in an affected Foxit PDF Reader/Editor, sees a 'valid signature' indication, and trusts tampered content (e.g., altered terms or figures). No public exploit code is identified at time of analysis; user interaction (opening and trusting the file) is required.