CVE-2025-55312

Foxit PDF and Editor for Windows (versions before 13.2 and 2025 before 2025.2 ) is vulnerable to a memory corruption issue. When pages are deleted via JavaScript , the application may fail to update internal states correctly. Subsequent annotation management operations may then dereference invali...

CVE-2025-55310

A security vulnerability exists in Foxit PDF and Editor for Windows and macOS affecting versions prior to 13.2 and 2025 (prior to 2025.2 ). The root cause is the application's failure to perform an integrity check when loading static HTML files used by the StartPage feature. An attacker capable o...

CVE-2025-55310: Download of Code Without Integrity Check

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML files used by the StartPage feature can cause the application to load malicious or compromised content upon startup. This may result in...

CVE-2025-59802: Authentication Bypass by Spoofing

Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups OCG are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamical...

CVE-2025-55313: Improper Control of Generation of Code

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when processing crafted PDF files. The vulnerability stems from insufficient handling of memory allocation failures after assigning an extremely...

CVE-2025-55312: NULL Pointer Dereference

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereferen...

CVE-2025-55314: NULL Pointer Dereference

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing...

CVE-2025-55309: Use After Free

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change...

CVE-2025-55308: Use After Free

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that calls closeDoc while internal objects are still in use can cause premature release of these objects. This use-after-free vulnerability may lead to memory...

CVE-2025-55307: Out-of-bounds Read

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query with a crafted cDIPath parameter e.g., "/" may cause an out-of-bounds read in internal path-parsing logic, potentially leadi...

CVE-2025-59803: Improper Verification of Cryptographic Signature

Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers e.g., JavaScript in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the...

CVE-2025-59803

Foxit PDF Editor and Foxit PDF Reader versions prior to 2025.2.1 are vulnerable to signature spoofing via triggers. An attacker can embed triggers, such as JavaScript , within a PDF document that execute during the signing process. While the document appears normal during review, the triggers mod...

CVE-2025-55307

An out-of-bounds read vulnerability exists in Foxit PDF and Editor for Windows (versions before 13.2 and 2025 before 2025.2 ) due to a flaw in internal path-parsing logic. This issue can be triggered by opening a malicious PDF file containing a crafted JavaScript call to search.query() with a spe...

CVE-2025-55309

Foxit PDF and Editor for Windows and macOS versions prior to 13.2 and 2025 versions prior to 2025.2 are vulnerable to a use-after-free vulnerability. The issue arises when a crafted PDF uses JavaScript to attach an OnBlur action on a form field to destroy an annotation; during a user right-click ...

CVE-2025-55314

A vulnerability exists in Foxit PDF and Editor for Windows and macOS versions before 13.2 and 2025 before 2025.2 . The flaw occurs when pages in a PDF are deleted via JavaScript , as the application may fail to update internal states correctly. Subsequent annotation management operations may then...

CVE-2025-59802

Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups OCG are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamical...

CVE-2025-59803

Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers e.g., JavaScript in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the...

CVE-2025-55313

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when processing crafted PDF files. The vulnerability stems from insufficient handling of memory allocation failures after assigning an extremely...

CVE-2025-55310

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML files used by the StartPage feature can cause the application to load malicious or compromised content upon startup. This may result in...

CVE-2025-55309

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change...