Foxit PDF and Editor for Windows Use-After-Free Vulnerability Leading to Memory Corruption and Information Disclosure

A use-after-free vulnerability has been identified in Foxit PDF Reader and Foxit PDF Editor for Windows, affecting versions prior to 13.2 and 2025 prior to 2025.2. The vulnerability arises when a crafted PDF containing JavaScript is opened, specifically if the JavaScript calls the closeDoc() function while internal objects are still in use. This can cause a premature release of these objects, leading to memory corruption. The exploitation of this vulnerability could result in unauthorized information disclosure.

Impact

Exploitation of this vulnerability may lead to memory corruption, with a potential for information disclosure when the manipulated PDF is opened.

Remediation

Users can update to Foxit PDF Reader 2025.2.1 or Foxit PDF Editor 2025.2.1/14.0.1/13.2.1. Instructions for updating are available on the Foxit website.