Foxit PDF Reader CVE-2025-55312

Exploitation requires the victim to open an attacker-crafted PDF in Foxit PDF Reader or Editor for Windows (builds before 13.2, or 2025 builds before 2025.2) with JavaScript execution enabled, which is the default. The malicious document must delete pages via JavaScript and then invoke annotation management operations to trigger the stale-state dereference. Limiting factors that materially reduce real-world risk: the vector is local file-based (AV:L), not network-reachable; user interaction is mandatory (UI:R - the user must open the file); and environments that disable PDF JavaScript, use a non-Foxit reader, or have already updated to 13.2 / 2025.2 are not exploitable.

This is a genuine but not emergency-grade priority. The CVSS 3.1 base score of 7.8 (HIGH) is driven by HIGH impact to confidentiality, integrity, and availability (C:H/I:H/A:H) combined with no privileges required (PR:N) and low attack complexity (AC:L). Critically, however, the attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - this is a client-side, file-open vulnerability (victim must open a malicious PDF), not a remotely reachable network service. Supporting signals point to LOW real-world urgency: EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The CWE (CWE-476, NULL Pointer Dereference) and the description's mention of 'dereference of invalid or released memory' most reliably support denial-of-service/crash outcomes; the 'potentially allow an attacker to execute arbitrary code' language is the vendor's own qualified claim and is not independently confirmed, so the C:H/I:H RCE impact should be treated as plausible-but-unproven. Net: patch in normal cycle for a widely-deployed client application, but this does not show the signature of active or imminent mass exploitation.

An attacker crafts a malicious PDF containing embedded JavaScript that deletes pages and then triggers annotation management operations, leaving the application referencing released or invalid memory. The victim is socially engineered (phishing attachment, malicious download, or web link) into opening the file in a vulnerable Foxit PDF Reader/Editor build, triggering memory corruption that at minimum crashes the application and potentially leads to code execution in the user's context. No public proof-of-concept was identified at the time of analysis, and successful exploitation requires local file access plus user interaction (UI:R).