Foxit PDF and Editor Out-of-Bounds Read Vulnerability Leading to Information Disclosure or Memory Corruption
Vulnerability
A vulnerability allowing an out-of-bounds read has been identified in Foxit PDF Reader and Foxit PDF Editor for Windows, prior to version 13.2 and in 2025 versions prior to 2025.2. This issue arises when a malicious PDF is opened, containing a crafted JavaScript call to search.query() with a manipulated cDIPath parameter. The flaw exists in the internal path-parsing logic, where improper validation allows reading data beyond allocated buffers. This could potentially lead to information disclosure or memory corruption.
Impact
Exploitation of this vulnerability could result in unauthorized information disclosure or memory corruption, which may be leveraged for further attacks.
Remediation
Users can update to Foxit PDF Reader 2025.2.1 or Foxit PDF Editor 2025.2.1/14.0.1/13.2.1. Instructions for updating are available on the Foxit website.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.