{"id":"CVE-2025-55307","title":"An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2","summary":"An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., \"/\") may cause an out-…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-125"],"vendor":"foxit","product":"pdf_editor","affected":["pdf_editor <= 13.1.7.23637","pdf_editor >= 2023.1.0.15510, <= 2023.3.0.23028","pdf_editor >= 2024.1.0.23997, <= 2024.4.1.27687","pdf_editor = 2025.1.0.27937","pdf_reader <= 2025.1.0.27937"],"published":"2025-12-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-55307","references":[{"url":"https://www.foxit.com/support/security-bulletins.html","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.0018,"epssPercentile":0.07008,"ingestedAt":"2026-10-14T21:57:04.798Z","slug":"CVE-2025-55307","body":"## Overview\n\nAn issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., \"/\") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption.\n\n## Affected\n\n- `pdf_editor <= 13.1.7.23637`\n- `pdf_editor >= 2023.1.0.15510, <= 2023.3.0.23028`\n- `pdf_editor >= 2024.1.0.23997, <= 2024.4.1.27687`\n- `pdf_editor = 2025.1.0.27937`\n- `pdf_reader <= 2025.1.0.27937`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}