PT-2025-52423 · Foxit · Foxit Pdf Reader

Hkx.H · Published 2025-12-19 · Updated 2025-12-24 · CVE-2025-66495

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader versions prior to 2025.2.1 Foxit PDF Reader versions prior to 14.0.1 Foxit PDF Reader version 13.2.1

Description A use-after-free issue exists in the way Foxit PDF Reader handles annotations. Opening a PDF file with specific JavaScript code can cause the software to access memory that has already been released. This could allow a remote attacker to run code on the system.

Recommendations Update Foxit PDF Reader to version 2025.2.1 or later. Update Foxit PDF Reader to version 14.0.1 or later. Update Foxit PDF Reader to a version later than 13.2.1.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-66495

ZDI-25-1176

Affected Products

Foxit Pdf Reader

References · 9

• https://zerodayinitiative.com/advisories/ZDI-25-1176 · Security Note
• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/727270 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66495 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66495 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2001984751431737528 · Twitter Post
• https://t.me/CVEtracker/40249 · Telegram Post
• https://twitter.com/CVEnew/status/2002099179867549994 · Twitter Post
• https://twitter.com/cracbot/status/2003782767189090495 · Twitter Post