Foxit PDF Reader and Foxit PDF Editor Use-After-Free Vulnerability Allowing Arbitrary Code Execution
Vulnerability
A use-after-free vulnerability has been identified in Foxit PDF Reader and Foxit PDF Editor. This issue affects versions prior to 2025.2.1, 14.0.1, and 13.2.1 on Windows. The vulnerability arises in the AcroForm handling, where a pointer to freed memory can be accessed or dereferenced. This flaw can be exploited by remote attackers to execute arbitrary code, particularly when a PDF containing specially crafted JavaScript is opened.
Impact
Exploitation of this vulnerability could lead to a crash of the application and allow for arbitrary code execution.
Remediation
Users can update to Foxit PDF Reader 2025.2.1 or Foxit PDF Editor 2025.2.1/14.0.1/13.2.1. Instructions for updating are available on the Foxit website.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.