What is the CVSS score of CVE-2025-55313?

CVE-2025-55313 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-55313?

Within 24 hours, inventory all Foxit PDF Reader and Foxit PDF Editor installations on Windows and macOS to identify versions prior to 13.2 (13.x line) and prior to 2025.2 (2025 line); disable JavaScript execution in Foxit preferences via the Preferences > JavaScript menu if not required by business processes, and consider blocking inbound PDF attachments from external senders at the email gateway. Within 7 days, deploy endpoint detection and response (EDR) rules to monitor for suspicious process creation from Foxit executables, and conduct user awareness training emphasizing the risk of opening unsolicited PDF files. Within 30 days, establish a process to monitor Foxit's security advisories and apply the vendor patch immediately upon release; if a patch is not forthcoming, evaluate alternative PDF readers for high-risk users and implement application isolation or sandboxing for Foxit.

Foxit PDF Reader CVE-2025-55313

HIGH

Code Injection (CWE-94)

2025-12-11 cve@mitre.org

RCE Buffer Overflow Apple Microsoft Code Injection Pdf Reader Pdf Editor

7.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Deliver crafted PDF via phishing
Delivery

Victim opens file in Foxit
Exploit

Embedded JavaScript sets huge charLimit
Execution

Allocation failure corrupts memory
Impact

Execute arbitrary code as user

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to open a maliciously crafted PDF in Foxit PDF Reader or PDF Editor for Windows or macOS at a version before 13.2 (13.x line) or before 2025.2 (2025 line). The specific trigger is PDF-embedded JavaScript that assigns an extremely large value to a form field's charLimit property, causing a mishandled memory-allocation failure and corruption. Limiting factors: exploitation is not remote-automatic - it is gated by required user interaction (UI:R, the user must open the attacker's file), depends on JavaScript execution being enabled in the PDF application, and reliable arbitrary code execution (versus a mere crash) requires additional memory-layout control; no authentication is needed (PR:N). Patched versions (13.2 / 2025.2 and later) are not affected.
Impact	Signals here are largely consistent and point to a real-but-not-urgent client-side RCE. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, 7.8 HIGH) correctly models a file-based attack: unauthenticated (PR:N) but requiring the victim to open a crafted PDF (AV:L + UI:R), with full C:H/I:H/A:H impact from memory corruption. Exploitation status is 'no public exploit identified at time of analysis' - the vulnerability is NOT in CISA KEV and no POC is referenced. EPSS reinforces low near-term risk at 0.18% (6th percentile), indicating no observed or predicted mass exploitation. No SSVC decision data was provided. One classification tension: the input CWE is CWE-94 (code injection) and tags include 'Code Injection', but the description actually describes a memory-corruption/heap condition triggered by an oversized charLimit allocation failure - CWE-787/CWE-120-class, with code execution as the downstream effect, not classic code injection; this is a labeling nuance, not a severity dispute. Overall this is a legitimate patch-worthy RCE but a routine-priority item (user-interaction-gated, no active exploitation, very low EPSS) rather than an emergency, and it should be prioritized for organizations with large Foxit deployments and users who routinely open external PDFs.
Exploit ScenarioDerived	An attacker crafts a malicious PDF containing embedded JavaScript that sets a form field's charLimit property to an extremely large value, triggering a memory-allocation failure that is mishandled and corrupts memory. The victim is persuaded (via phishing email or a download link) to open the file in a vulnerable Foxit PDF Reader or Editor, after which the corruption can be leveraged to execute arbitrary code in the user's context. No public exploit code is currently identified, and successful exploitation requires reliable heap/control-flow manipulation beyond the crash itself.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 14, 2026

Arbitrary code execution is possible in Foxit PDF Reader and Foxit PDF Editor on Windows and macOS when a user opens a crafted PDF, with versions before 13.2 (13.x line) and before 2025.2 (2025 line) affected. The flaw is triggered by PDF-embedded JavaScript that assigns an extremely large value to a form field's charLimit property, producing an unhandled memory-allocation failure that corrupts memory and can be leveraged for code execution; the attacker must persuade the victim to open the malicious file, so exploitation requires user interaction and JavaScript enabled in the application, and no authentication is needed (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV), and EPSS is low at roughly 0.18% (6th percentile), so this is a real but not urgent client-side code-execution risk concentrated on unpatched endpoints.

RemediationAI

Vendor-released patch: upgrade Foxit PDF Reader and Foxit PDF Editor on both Windows and macOS to version 13.2 or 2025.2 (or later) as documented in the Foxit security bulletins at https://www.foxit.com/support/security-bulletins.html; these patched builds are not affected. Where immediate upgrades are not possible, disable JavaScript execution in the application (in Foxit, Preferences > JavaScript, uncheck 'Enable JavaScript Actions'), which blocks the charLimit trigger - the trade-off is that interactive PDF forms and scripted documents will no longer function correctly. Additional compensating controls include opening untrusted PDFs only in a sandboxed or low-privilege viewer or VM, restricting users from handling PDFs from unknown senders through email and download channels, and stripping or blocking JavaScript from inbound PDFs at the mail/web gateway where a PDF-sanitization capability exists, though such sanitization can corrupt legitimate interactive documents and is not a substitute for patching. Because the vector requires the user to open the malicious file (UI:R), user awareness around unsolicited PDF attachments remains a meaningful risk reduction while endpoints are being updated, and there is no evidence of active exploitation, so patching can follow normal prioritized cycles driven by the 7.8 severity and the widespread deployment of these readers.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This is a client-side memory-safety/code-injection flaw (CWE-94) in the PDF rendering stack of Foxit's Windows and macOS products. PDF files can embed JavaScript, and form fields expose a charLimit property that governs the maximum number of characters a field accepts; assigning an extremely large value to that property through scripting causes a memory-allocation request to fail, and Foxit's handling of that failure is insufficient, leading to memory corruption that an attacker can steer toward arbitrary code execution. The underlying issue class is therefore improper handling of an exceptional condition (allocation failure) rather than a classic malformed-file parser overflow, and exploitation depends on the application actually executing the embedded JavaScript. CPE data confirms the affected product families as foxit:pdf_reader and foxit:pdf_editor across both the 13.x and 2025 release lines, with the version-specific entries 2025.1.0.27937 and 2025.1.0.66692 falling inside the vulnerable range; the 13.x and 2025 lines converge on the fixed 13.2 and 2025.2 releases respectively. Because the attack surface is the document-open path, the exploit chain begins with the target double-clicking or opening an attacker-supplied PDF.

Know when Pdf Reader gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

File must be locally opened by the victim so AV:L and UI:R; no privileges needed (PR:N), and arbitrary code execution yields full C:H/I:H/A:H in the user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when processing crafted PDF files. The vulnerability stems from insufficient handling of memory allocation failures after assigning an extremely large value to a form field's charLimit property via JavaScript. This can result in memory corruption and may allow an attacker to execute arbitrary code by persuading a user to open a malicious file.

Executive ViewAI

Why It Matters

Unpatched installations of Foxit PDF Reader and Foxit PDF Editor on Windows and macOS are vulnerable to a high-severity flaw that allows attackers to execute arbitrary code when a user opens a specially crafted PDF file. While no public exploit identified at time of analysis, the vulnerability requires only user interaction and could lead to full system compromise if leveraged. Organizations with large numbers of endpoints running affected versions should prioritize mitigation, as the risk is concentrated on these systems and could result in data loss or lateral movement if exploited.

Business Impact: High

Compensating Controls

Disable JavaScript execution in Foxit preferences (if not required), enforce email filtering to block malicious PDF attachments, educate users on opening unsolicited PDFs, and implement endpoint detection rules for suspicious process activity.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

High

Foxit PDF Reader/Editor is a widely deployed enterprise and consumer PDF suite

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.