What is the CVSS score of CVE-2025-55314?

CVE-2025-55314 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-55314?

Within 24 hours, inventory all Foxit PDF Reader and PDF Editor installations on Windows and macOS, focusing on versions earlier than 13.2 or 2025 releases earlier than 2025.2, and disable JavaScript execution within the application as an interim mitigation; also communicate to users the risk of opening untrusted PDFs. Within 7 days, implement application sandboxing or restrict PDF viewing to alternative trusted viewers for untrusted documents, and continuously monitor vendor advisories for a patch. Within 30 days, if a vendor patch is released, deploy it immediately; otherwise, continue enforcing least privilege and endpoint detection controls to mitigate potential exploitation.

Foxit PDF Reader CVE-2025-55314

HIGH

NULL Pointer Dereference (CWE-476)

2025-12-11 cve@mitre.org

RCE Buffer Overflow Denial Of Service Null Pointer Dereference Apple Microsoft Pdf Reader Pdf Editor

7.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Deliver crafted PDF to victim
Exploit

Victim opens file in vulnerable Foxit
Execution

Embedded JavaScript deletes pages then runs annotation op
Impact

Dereference released memory for crash or code execution

Vulnerability Assessment

Weakness	CWE CWE-476 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Null pointer safety, defensive checks MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a user to open an attacker-crafted PDF in Foxit PDF Reader or Editor (Windows or macOS) on a version before 13.2 or 2025 before 2025.2, with JavaScript execution enabled in the application (the default). The malicious document must programmatically delete PDF pages via JavaScript and then invoke annotation management operations to trigger the stale/released-memory dereference. Limiting factors: exploitation is LOCAL and file-based (AV:L), it needs active user interaction to open the document (UI:R), it depends on in-app JavaScript not being disabled by policy, and reaching code execution rather than a mere crash is described only as potential, not demonstrated.
Impact	This is a memory-corruption flaw (use-after-free/invalid dereference following JavaScript-driven page deletion, classed CWE-476) rated CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R. The LOCAL attack vector plus required user interaction (UI:R) are the dominant risk-limiting signals: exploitation is file-based, requiring a victim to open a malicious PDF in Foxit rather than any remote/network trigger, which is why a 'High' CVSS does not translate to broad, automatable mass-exploitation. The real-world exploitation signals are weak and consistent with each other: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data - so this is currently a patch-on-normal-cycle item rather than an emergency. One internal tension to verify: the CWE is NULL Pointer Dereference (CWE-476), which typically yields only a crash/DoS, yet the description and the supplied vector claim full C:H/I:H/A:H with 'potentially execute arbitrary code' - the confidentiality/integrity impact and RCE potential are asserted but not demonstrated, so the practical worst case may in many deployments be an application crash. No SSVC decision data was provided in the input.
Exploit ScenarioDerived	An attacker crafts a PDF containing embedded JavaScript that deletes pages and then performs annotation management operations, then delivers it to a victim via email, download, or a web link. When the victim opens the document in a vulnerable Foxit PDF Reader/Editor build with JavaScript enabled, the stale internal state is dereferenced, crashing the application and potentially allowing arbitrary code execution in the user's context. No public exploit code was identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 14, 2026

Memory corruption in Foxit PDF Reader and PDF Editor for Windows and macOS (versions before 13.2 and 2025 releases before 2025.2) can be triggered when a crafted PDF uses JavaScript to delete pages and then perform annotation management operations on the now-stale internal state, leading to a dereference of invalid or released memory (CWE-476). An attacker who convinces a user to open a malicious PDF can cause an application crash and potentially achieve arbitrary code execution, though code execution is described as potential rather than demonstrated; the assessed vector is CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning unauthenticated but requiring local file interaction and user participation. The flaw remains at low observed exploitation risk (EPSS 0.20%, 9th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing; a vendor patch is available.

RemediationAI

Vendor-released patch: upgrade Foxit PDF Reader and Foxit PDF Editor to version 13.2 or to 2025.2 (or later) for Windows and macOS, as directed by the Foxit security bulletins page at https://www.foxit.com/support/security-bulletins.html; verify the installed build via Help > About so that interim 2025.1.x builds such as 2025.1.0.27937 are not mistaken for patched. Configuring Foxit's updater for automatic updates or pushing the new build through enterprise software distribution will close the gap for managed fleets. If immediate upgrade is not possible, the most effective compensating control is to disable JavaScript execution in the application (Preferences > JavaScript, uncheck 'Enable JavaScript Actions', or disable it centrally through the Foxit customization/registry settings, or via Group Policy/enterprise configuration) - a trade-off that breaks interactive forms, form calculations, and scripted document workflows. Restricting users from opening untrusted PDFs from email or web downloads and routing them through a sanitizer or a viewer without scripting support further reduces attack surface, but note that these are partial mitigations: they prevent the JavaScript-driven page-deletion trigger rather than repairing the underlying stale-memory handling, and they do not protect users who re-enable scripting or open documents outside the restricted workflow.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability sits in the annotation management subsystem of Foxit's PDF engine. PDF JavaScript (the same scripting model used for form logic, validation, and document automation) can call methods that delete pages from an open document. Under affected versions, that deletion path fails to invalidate or consistently update the engine's internal page/annotation state objects. When a subsequent annotation operation (for example adding, moving, or querying annotations) walks those structures, it dereferences a pointer that has already been freed or is otherwise invalid - the classic use-after-free/invalid-dereference pattern that NVD classifies as CWE-476 (NULL pointer dereference) but which the tags and advisory framing treat as memory corruption with RCE potential. Because these internal objects underpin rendering, editing, and annotation layers, corruption can surface as an access violation (crash/denial of service) or, if the freed chunk is reliably shaped, as controllable memory that a determined attacker could redirect toward code execution. CPE data identifies the affected product families as foxit:pdf_editor and foxit:pdf_reader, with a confirmed affected build 2025.1.0.27937 and all versions below the 13.2 / 2025.2 thresholds on both Windows and macOS.

Know when Pdf Reader gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

File-based exploitation via opening a malicious PDF gives AV:L/UI:R with no prior privileges (PR:N); high impacts retained to reflect the claimed memory-corruption/code-execution potential, though CWE-476 alone would often justify A:H only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereference of invalid or released memory. This can lead to memory corruption, application crashes, and potentially allow an attacker to execute arbitrary code.

Executive ViewAI

Why It Matters

Foxit PDF Reader and Editor for Windows and macOS contain a memory corruption vulnerability that could allow an attacker to execute arbitrary code when a user opens a malicious PDF. Organizations running versions prior to 13.2 or 2025 releases prior to 2025.2 are affected, and although no public exploit identified at time of analysis, the high severity rating and potential for system compromise warrant immediate attention. Leadership should prioritize remediation efforts to protect sensitive data and maintain business continuity.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include disabling JavaScript execution in Foxit PDF Reader/Editor, avoiding opening PDFs from untrusted sources, using alternative PDF viewers for untrusted documents, applying least privilege, and enabling endpoint exploit protection features.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

High

Foxit Reader/Editor is a widely deployed enterprise and consumer Adobe alternative

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.