PT-2025-52421 · Foxit · Foxit Pdf Editor+1

Published 2025-12-19 · Updated 2025-12-24 · CVE-2025-66493

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader versions prior to 2025.2.1 Foxit PDF Editor versions prior to 2025.2.1, 14.0.1 and 13.2.1

Description A use-after-free issue exists in the AcroForm handling of the software. Opening a PDF file with specially crafted JavaScript can lead to accessing or dereferencing a pointer to already freed memory. This could allow a remote attacker to potentially execute arbitrary code.

Recommendations Update Foxit PDF Reader to version 2025.2.1 or later. Update Foxit PDF Editor to version 2025.2.1, 14.0.1, or 13.2.1 or later.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-66493

ZDI-25-1174

Affected Products

Foxit Pdf Editor

Foxit Pdf Reader

References · 9

• https://zerodayinitiative.com/advisories/ZDI-25-1174 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66493 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66493 · Vendor Advisory
• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/727272 · Security Note
• https://twitter.com/CVEnew/status/2002099181973090767 · Twitter Post
• https://t.me/CVEtracker/40247 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002000111702843437 · Twitter Post
• https://twitter.com/cracbot/status/2003782763741356200 · Twitter Post