Foxit PDF Editor CVE-2025-59803

Exploitation requires the victim to be a signer who opens an attacker-supplied PDF in a vulnerable Foxit PDF Editor or Reader (before 2025.2.1 / 14.0.1 / 13.2.1) and then applies a digital signature to it; the embedded triggers (e.g., JavaScript) execute specifically during the signing process to modify other pages or optional content layers without an explicit warning. The decisive limiting factors are: (1) mandatory user interaction - the attack only succeeds if the target actually performs the signing action, not merely by viewing the file (UI:R); (2) it depends on trigger/JavaScript execution being permitted during signing; and (3) impact is confined to document integrity/signature trust - there is no code execution, data disclosure, or availability loss. It is therefore most relevant where Foxit is used for authoritative digital signing of legal or financial documents.

This is a moderate-severity integrity flaw (CVSS 5.3, CWE-347 Improper Verification of Cryptographic Signature) that is NOT a top-tier patching priority but matters acutely for signature-dependent workflows. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) tells a consistent story: no privileges needed (PR:N) but the attack hinges on social engineering a legitimate signer into opening and signing a malicious document (UI:R), and crafting the trigger payload raises attack complexity (AC:H). All impact is to integrity (I:H) with no confidentiality or availability effect - meaning the real-world damage is trust/non-repudiation, not data theft or system compromise. The exploitation signals reinforce a low urgency: EPSS is 0.17% (6th percentile), the CVE is NOT on CISA KEV, and no public exploit was supplied, so there is no public exploit identified at time of analysis. CONFLICT/CAVEAT: the input Tags label this 'Information Disclosure' and 'Jwt Attack', but the CVSS vector shows C:N (no confidentiality impact) and the description is a PDF digital-signature spoofing issue - neither tag matches the actual vulnerability, which is signature integrity. Treat the 'Information Disclosure'/'Jwt Attack' categorization as erroneous metadata, not a second attack class. Net: genuine concern for organizations that rely on Foxit digital signatures for legal/financial attestation, but low probability of mass exploitation.

An attacker sends a specially crafted PDF containing embedded triggers (e.g., JavaScript) to a target who uses Foxit PDF Editor/Reader as their document signer. The content looks benign during review, but the act of applying the digital signature fires the triggers, silently altering content on other pages or optional-content layers so the signed, 'trusted' document no longer matches what the signer approved. No public exploit code was provided, and the attack requires the victim to actually sign the document (UI:R).