Foxit PDF Editor CVE-2025-59802

Exploitation requires that the targeted document uses Optional Content Groups (OCG/layers) and that the attacker can embed JavaScript or PDF action triggers that toggle OCG visibility state - which the CVE states is runtime-only and excluded from the signature computation buffer. The attacker must be able to deliver a signed PDF whose layer states were altered post-signing. The key limiting factor is that impact only occurs against a verifier who opens the document in a vulnerable Foxit version (before 2025.2.1 / 14.0.1 / 13.2.1) and relies on its signature-validity indication; the attack does not compromise the host, grants no code execution, and affects only the integrity/trust of displayed signed content. It applies to default Foxit configurations that support OCG rendering and JavaScript/PDF triggers.

This is a genuine integrity flaw but a moderate, not top-tier, priority. The CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) is driven entirely by the High integrity impact - there is no confidentiality or availability exposure. Real-world signals temper the headline score: EPSS is only 0.32% (23rd percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit code was identified in the provided intelligence, so exploitation status is speculative rather than demonstrated. One signal to scrutinize is the UI:N in the supplied vector: this is a digital-signature-spoofing attack whose impact only materializes when a human verifier opens and visually trusts the signed PDF, which in practice is a user-interaction step - the published vector arguably overstates automatability by marking UI:N. The vulnerability class (CWE-290, spoofing) is high-value for fraud/social-engineering against document-trust workflows (contracts, approvals, financial/legal documents) rather than for direct system compromise, so it is a targeted-deception risk, not a mass-exploitation RCE. Net: a real and worth-patching trust-model defect, but its true danger is contextual (who relies on Foxit signature validation) rather than reflected by broad opportunistic exploitation.

An attacker obtains or crafts a PDF, has it legitimately signed (or intercepts a signed document), then adds Optional Content Group layers whose runtime-only visibility state is excluded from the signature buffer. Using embedded JavaScript or PDF action triggers, the layers are toggled after signing so the rendered content differs from what was signed, while Foxit still reports the signature as valid. The forged document is delivered to a victim (e.g., a counterparty or approver) who opens it in Foxit, sees fraudulent terms, and trusts them because the signature appears intact. No public exploit code was identified at time of analysis.