CVE-2025-55307Low· 3.3▾ SunlitAn issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption.
pdf_editor <= 13.1.7.23637pdf_editor >= 2023.1.0.15510, <= 2023.3.0.23028pdf_editor >= 2024.1.0.23997, <= 2024.4.1.27687pdf_editor = 2025.1.0.27937pdf_reader <= 2025.1.0.27937Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91817Medium· 6.1A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript
CVE-2026-91810Medium· 6.1A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks
CVE-2026-91808Medium· 6.1A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata
CVE-2025-59802High· 7.5Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG
CVE-2025-59803Medium· 5.3Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers
CVE-2025-55312High· 7.8An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2