Foxit PDF Reader PRC File Parsing Out-of-Bounds Read Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Foxit PDF Reader versions 2025.1.0.27937 and earlier for Windows, as well as in Foxit PDF Editor for Mac versions 2025.1.0.66692 and earlier. This vulnerability arises from improper validation of user-supplied data when parsing PRC files, leading to an out-of-bounds read that allows attackers to execute arbitrary code on the affected system. Exploitation requires user interaction, such as opening a malicious file or visiting a harmful webpage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Users can update to Foxit PDF Reader 2025.2 or Foxit PDF Editor 2025.2 for Windows or Mac. Instructions for updating or downloading the latest versions are available on the Foxit website.