Foxit PDF Reader and Foxit PDF Editor Use-After-Free Vulnerability Allowing Arbitrary Code Execution

A use-after-free vulnerability has been identified in Foxit PDF Reader and Foxit PDF Editor. This vulnerability affects versions prior to 2025.2.1, 14.0.1, and 13.2.1 on Windows and macOS. The issue arises in the annotation handling process, where the application can access or dereference a pointer to memory that has already been freed. This flaw can be exploited by remote attackers to execute arbitrary code, particularly when a PDF containing specially crafted JavaScript is opened.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the user's system.

Remediation

Users can update to Foxit PDF Reader 2025.3 or Foxit PDF Editor 2025.3/14.0.2/13.2.2. Instructions for updating or downloading the latest versions are available on the Foxit website.