Pdf Reader
Monthly
Foxit PDF Editor and Foxit PDF Reader fail to consistently alert users when digital signature fields are manipulated - including alterations to field appearance streams, coordinate repositioning, or field duplication within a document. An attacker who delivers a specially crafted PDF to a target can exploit the flawed UI feedback to make a tampered document appear validly signed, directly undermining the integrity assurance that digital signatures exist to provide. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Signature spoofing in Foxit PDF Editor and Reader before 2025.2.1, 14.0.1, and 13.2.1 lets a remote, unauthenticated attacker embed triggers such as JavaScript in a PDF so that content on other pages or optional content layers is silently modified at the moment the signer applies a digital signature - the signed file then differs from what the signer reviewed. Exploitation is not automatic: it requires the target to open an attacker-supplied document and actively perform the signing action (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, 5.3, CWE-347), and there is no code execution, data disclosure, or availability impact. No public exploit code was identified at time of analysis and EPSS is only 0.17% (6th percentile), so this is not a mass-exploitation priority, but the embedded-trigger technique is directly relevant to organizations that rely on Foxit for authoritative legal, financial, or contractual signing workflows where the evidentiary value of a signature is the thing being protected.
Signature spoofing in Foxit PDF Editor and Foxit PDF Reader (versions before 2025.2.1, 14.0.1, and 13.2.1) allows a crafted, already-signed PDF to display different visible content than what the signer actually signed, while the signature still reports as valid. Because Optional Content Group (OCG/layer) visibility state is runtime-only and excluded from the digital signature computation buffer, an attacker can embed JavaScript or PDF action triggers that toggle layer visibility after signing, defeating the integrity guarantee a verifier relies on. The issue requires the victim to open the document in an affected Foxit build (assessed as requiring user interaction), causes no code execution or host compromise, and there is no public exploit identified at time of analysis; EPSS is low at 0.32% (23rd percentile), and vendor patches are available.
Memory corruption in Foxit PDF Reader and PDF Editor for Windows and macOS (versions before 13.2 and 2025 releases before 2025.2) can be triggered when a crafted PDF uses JavaScript to delete pages and then perform annotation management operations on the now-stale internal state, leading to a dereference of invalid or released memory (CWE-476). An attacker who convinces a user to open a malicious PDF can cause an application crash and potentially achieve arbitrary code execution, though code execution is described as potential rather than demonstrated; the assessed vector is CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning unauthenticated but requiring local file interaction and user participation. The flaw remains at low observed exploitation risk (EPSS 0.20%, 9th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing; a vendor patch is available.
Arbitrary code execution is possible in Foxit PDF Reader and Foxit PDF Editor on Windows and macOS when a user opens a crafted PDF, with versions before 13.2 (13.x line) and before 2025.2 (2025 line) affected. The flaw is triggered by PDF-embedded JavaScript that assigns an extremely large value to a form field's charLimit property, producing an unhandled memory-allocation failure that corrupts memory and can be leveraged for code execution; the attacker must persuade the victim to open the malicious file, so exploitation requires user interaction and JavaScript enabled in the application, and no authentication is needed (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV), and EPSS is low at roughly 0.18% (6th percentile), so this is a real but not urgent client-side code-execution risk concentrated on unpatched endpoints.
Memory corruption in Foxit PDF Reader and PDF Editor for Windows (builds before 13.2 and 2025 builds before 2025.2) can crash the application and potentially allow arbitrary code execution when a victim opens a crafted PDF. The trigger is document JavaScript that deletes pages, leaving the viewer's internal state stale so that a later annotation-management operation dereferences invalid or already-freed memory (CWE-476). Exploitation requires the user to open the malicious file with JavaScript enabled, which is the default; the attack is file-based and local (AV:L, UI:R), not remotely reachable. No public exploit code has been identified at time of analysis, and EPSS is low at roughly 0.15% (4th percentile), so this is a genuine but not emergency-grade priority - environments that disable PDF JavaScript, use a non-Foxit reader, or have already moved to 13.2 / 2025.2 are not exposed.
Digitally signed PDFs can be silently altered in Foxit PDF Editor and Foxit PDF Reader on Windows and macOS before 13.2 and 2025 before 2025.2 without the client's signature-verification indication reflecting the change. An attacker crafts a PDF whose embedded JavaScript rewrites annotation content and then clears the document's modification status, so the file still appears to be a valid, unmodified, signed document that users are misled into trusting. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N means unauthenticated remote delivery of the file but mandatory victim interaction (opening the PDF and relying on the signature display), with high integrity impact and no confidentiality or availability impact; there is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and the issue is not in CISA KEV, so this is a moderate trust/integrity issue rather than a code-execution emergency.
Authenticated local attackers with write access to Foxit PDF Editor and Foxit PDF Reader's StartPage HTML files on Windows or macOS can inject malicious content that executes when the application starts, leading to potential information disclosure or unauthorized data access. Affected versions include those before 13.2 for the 13.x branch and before 2025.2 for the 2025 branch. Although the CVSS base score is 7.3, the vulnerability is not remotely exploitable and requires local file-write permissions plus user interaction, making it a moderate-severity, low-urgency issue; no public exploit or active exploitation has been identified.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor for Windows and macOS (versions before 13.2 and 2025 releases before 2025.2) allows an attacker to corrupt memory or crash the application by delivering a crafted PDF containing JavaScript that attaches an OnBlur action to a form field, destroying an annotation; the victim must then right-click that field so internal focus-change handling prematurely releases the annotation object. The vector is local with high attack complexity and required user interaction (assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 6.7), and there is no public exploit identified at time of analysis - EPSS is low at 0.14% (3rd percentile) and the issue is not in CISA KEV. This is a genuine but moderate-priority client-side memory-safety flaw whose practical exploitability depends on winning a focus-handling race rather than on a trivial one-click trigger.
Use-after-free in Foxit PDF Reader and PDF Editor for Windows (older than 13.2, and 2025 builds older than 2025.2) allows an attacker who convinces a user to open a crafted PDF to corrupt memory in the rendering process. The trigger is embedded JavaScript that calls closeDoc() while internal document objects are still referenced, leaving dangling pointers that can be reused for information disclosure and, per the assessed vector, high confidentiality impact with limited integrity and availability impact. Exploitation is not remote-automatable: it requires local delivery of a malicious file plus explicit user interaction, and the high attack-complexity rating reflects a timing/state-dependent condition that does not trigger reliably; there is no public exploit identified at time of analysis and EPSS is only 0.14% (3rd percentile), so this is a genuine but moderate-priority issue rather than a top-tier emergency.
An out-of-bounds read in Foxit PDF Reader and PDF Editor for Windows (versions before 13.2, and 2025 builds before 2025.2) is reachable when a victim opens an attacker-supplied PDF whose embedded JavaScript calls search.query() with a crafted cDIPath parameter such as '/'. Exploitation is strictly local and requires the user to open the malicious file with Foxit's JavaScript engine enabled, and the assessed impact is limited to low-confidentiality information disclosure rather than code execution. There is no public exploit identified at time of analysis; CISA KEV does not list this CVE and EPSS is only 0.18% (7th percentile), consistent with a low-priority finding.
Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Doc Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader template Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader template Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Editor and Foxit PDF Reader fail to consistently alert users when digital signature fields are manipulated - including alterations to field appearance streams, coordinate repositioning, or field duplication within a document. An attacker who delivers a specially crafted PDF to a target can exploit the flawed UI feedback to make a tampered document appear validly signed, directly undermining the integrity assurance that digital signatures exist to provide. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Signature spoofing in Foxit PDF Editor and Reader before 2025.2.1, 14.0.1, and 13.2.1 lets a remote, unauthenticated attacker embed triggers such as JavaScript in a PDF so that content on other pages or optional content layers is silently modified at the moment the signer applies a digital signature - the signed file then differs from what the signer reviewed. Exploitation is not automatic: it requires the target to open an attacker-supplied document and actively perform the signing action (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, 5.3, CWE-347), and there is no code execution, data disclosure, or availability impact. No public exploit code was identified at time of analysis and EPSS is only 0.17% (6th percentile), so this is not a mass-exploitation priority, but the embedded-trigger technique is directly relevant to organizations that rely on Foxit for authoritative legal, financial, or contractual signing workflows where the evidentiary value of a signature is the thing being protected.
Signature spoofing in Foxit PDF Editor and Foxit PDF Reader (versions before 2025.2.1, 14.0.1, and 13.2.1) allows a crafted, already-signed PDF to display different visible content than what the signer actually signed, while the signature still reports as valid. Because Optional Content Group (OCG/layer) visibility state is runtime-only and excluded from the digital signature computation buffer, an attacker can embed JavaScript or PDF action triggers that toggle layer visibility after signing, defeating the integrity guarantee a verifier relies on. The issue requires the victim to open the document in an affected Foxit build (assessed as requiring user interaction), causes no code execution or host compromise, and there is no public exploit identified at time of analysis; EPSS is low at 0.32% (23rd percentile), and vendor patches are available.
Memory corruption in Foxit PDF Reader and PDF Editor for Windows and macOS (versions before 13.2 and 2025 releases before 2025.2) can be triggered when a crafted PDF uses JavaScript to delete pages and then perform annotation management operations on the now-stale internal state, leading to a dereference of invalid or released memory (CWE-476). An attacker who convinces a user to open a malicious PDF can cause an application crash and potentially achieve arbitrary code execution, though code execution is described as potential rather than demonstrated; the assessed vector is CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning unauthenticated but requiring local file interaction and user participation. The flaw remains at low observed exploitation risk (EPSS 0.20%, 9th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing; a vendor patch is available.
Arbitrary code execution is possible in Foxit PDF Reader and Foxit PDF Editor on Windows and macOS when a user opens a crafted PDF, with versions before 13.2 (13.x line) and before 2025.2 (2025 line) affected. The flaw is triggered by PDF-embedded JavaScript that assigns an extremely large value to a form field's charLimit property, producing an unhandled memory-allocation failure that corrupts memory and can be leveraged for code execution; the attacker must persuade the victim to open the malicious file, so exploitation requires user interaction and JavaScript enabled in the application, and no authentication is needed (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV), and EPSS is low at roughly 0.18% (6th percentile), so this is a real but not urgent client-side code-execution risk concentrated on unpatched endpoints.
Memory corruption in Foxit PDF Reader and PDF Editor for Windows (builds before 13.2 and 2025 builds before 2025.2) can crash the application and potentially allow arbitrary code execution when a victim opens a crafted PDF. The trigger is document JavaScript that deletes pages, leaving the viewer's internal state stale so that a later annotation-management operation dereferences invalid or already-freed memory (CWE-476). Exploitation requires the user to open the malicious file with JavaScript enabled, which is the default; the attack is file-based and local (AV:L, UI:R), not remotely reachable. No public exploit code has been identified at time of analysis, and EPSS is low at roughly 0.15% (4th percentile), so this is a genuine but not emergency-grade priority - environments that disable PDF JavaScript, use a non-Foxit reader, or have already moved to 13.2 / 2025.2 are not exposed.
Digitally signed PDFs can be silently altered in Foxit PDF Editor and Foxit PDF Reader on Windows and macOS before 13.2 and 2025 before 2025.2 without the client's signature-verification indication reflecting the change. An attacker crafts a PDF whose embedded JavaScript rewrites annotation content and then clears the document's modification status, so the file still appears to be a valid, unmodified, signed document that users are misled into trusting. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N means unauthenticated remote delivery of the file but mandatory victim interaction (opening the PDF and relying on the signature display), with high integrity impact and no confidentiality or availability impact; there is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and the issue is not in CISA KEV, so this is a moderate trust/integrity issue rather than a code-execution emergency.
Authenticated local attackers with write access to Foxit PDF Editor and Foxit PDF Reader's StartPage HTML files on Windows or macOS can inject malicious content that executes when the application starts, leading to potential information disclosure or unauthorized data access. Affected versions include those before 13.2 for the 13.x branch and before 2025.2 for the 2025 branch. Although the CVSS base score is 7.3, the vulnerability is not remotely exploitable and requires local file-write permissions plus user interaction, making it a moderate-severity, low-urgency issue; no public exploit or active exploitation has been identified.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor for Windows and macOS (versions before 13.2 and 2025 releases before 2025.2) allows an attacker to corrupt memory or crash the application by delivering a crafted PDF containing JavaScript that attaches an OnBlur action to a form field, destroying an annotation; the victim must then right-click that field so internal focus-change handling prematurely releases the annotation object. The vector is local with high attack complexity and required user interaction (assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 6.7), and there is no public exploit identified at time of analysis - EPSS is low at 0.14% (3rd percentile) and the issue is not in CISA KEV. This is a genuine but moderate-priority client-side memory-safety flaw whose practical exploitability depends on winning a focus-handling race rather than on a trivial one-click trigger.
Use-after-free in Foxit PDF Reader and PDF Editor for Windows (older than 13.2, and 2025 builds older than 2025.2) allows an attacker who convinces a user to open a crafted PDF to corrupt memory in the rendering process. The trigger is embedded JavaScript that calls closeDoc() while internal document objects are still referenced, leaving dangling pointers that can be reused for information disclosure and, per the assessed vector, high confidentiality impact with limited integrity and availability impact. Exploitation is not remote-automatable: it requires local delivery of a malicious file plus explicit user interaction, and the high attack-complexity rating reflects a timing/state-dependent condition that does not trigger reliably; there is no public exploit identified at time of analysis and EPSS is only 0.14% (3rd percentile), so this is a genuine but moderate-priority issue rather than a top-tier emergency.
An out-of-bounds read in Foxit PDF Reader and PDF Editor for Windows (versions before 13.2, and 2025 builds before 2025.2) is reachable when a victim opens an attacker-supplied PDF whose embedded JavaScript calls search.query() with a crafted cDIPath parameter such as '/'. Exploitation is strictly local and requires the user to open the malicious file with Foxit's JavaScript engine enabled, and the assessed impact is limited to low-confidentiality information disclosure rather than code execution. There is no public exploit identified at time of analysis; CISA KEV does not list this CVE and EPSS is only 0.18% (7th percentile), consistent with a low-priority finding.
Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Doc Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader template Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader template Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.