PT-2025-52422 · Foxit · Foxit Pdf Reader

Published 2025-12-19 · Updated 2025-12-24 · CVE-2025-66494

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader versions prior to 2025.2.1 Foxit PDF Reader versions prior to 14.0.1 Foxit PDF Reader versions prior to 13.2.1

Description A use-after-free issue exists in the way Foxit PDF Reader processes PDF files. Specifically, a PDF object that is managed by multiple parent objects may be freed from memory while still being referenced. This situation could potentially allow a remote attacker to execute arbitrary code.

Recommendations Update Foxit PDF Reader to version 2025.2.1 or later. Update Foxit PDF Reader to version 14.0.1 or later. Update Foxit PDF Reader to version 13.2.1 or later.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-66494

ZDI-25-1175

Affected Products

Foxit Pdf Reader

References · 8

• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66494 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-1175 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66494 · Vendor Advisory
• https://twitter.com/cracbot/status/2003782765465211366 · Twitter Post
• https://t.me/CVEtracker/40248 · Telegram Post
• https://twitter.com/CVEnew/status/2002099180920320035 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001994991275585703 · Twitter Post