{"id":"CVE-2025-55309","title":"An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2","summary":"An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"foxit","product":"pdf_editor","affected":["pdf_editor <= 13.1.7.63027","pdf_editor >= 2023.1.0.55583, <= 2023.3.0.63083","pdf_editor >= 2024.1.0.63682, <= 2024.4.1.66479","pdf_editor = 2025.1.0.66692","pdf_reader <= 2025.1.0.66692","pdf_editor <= 13.1.7.23637","pdf_editor >= 2023.1.0.15510, <= 2023.3.0.23028","pdf_editor >= 2024.1.0.23997, <= 2024.4.1.27687","pdf_editor = 2025.1.0.27937","pdf_reader <= 2025.1.0.27937"],"published":"2025-12-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-55309","references":[{"url":"https://www.foxit.com/support/security-bulletins.html","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00137,"epssPercentile":0.02772,"ingestedAt":"2026-10-14T21:57:04.799Z","slug":"CVE-2025-55309","body":"## Overview\n\nAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change handling prematurely releases the annotation object, resulting in a use-after-free vulnerability that may cause memory corruption or application crashes.\n\n## Affected\n\n- `pdf_editor <= 13.1.7.63027`\n- `pdf_editor >= 2023.1.0.55583, <= 2023.3.0.63083`\n- `pdf_editor >= 2024.1.0.63682, <= 2024.4.1.66479`\n- `pdf_editor = 2025.1.0.66692`\n- `pdf_reader <= 2025.1.0.66692`\n- `pdf_editor <= 13.1.7.23637`\n- `pdf_editor >= 2023.1.0.15510, <= 2023.3.0.23028`\n- `pdf_editor >= 2024.1.0.23997, <= 2024.4.1.27687`\n- `pdf_editor = 2025.1.0.27937`\n- `pdf_reader <= 2025.1.0.27937`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}