CVE-2025-55308
📋 TL;DR
A use-after-free vulnerability in Foxit PDF and Editor for Windows allows memory corruption when opening a malicious PDF containing JavaScript that calls closeDoc() prematurely. This could lead to information disclosure. Users of affected Foxit software versions on Windows are at risk.
💻 Affected Systems
- Foxit PDF Reader
- Foxit PDF Editor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, complete system compromise, or sensitive data exfiltration.
Likely Case
Application crash or information disclosure from memory corruption.
If Mitigated
Application crash without data loss if security controls prevent code execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious PDF. JavaScript execution is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Foxit PDF Reader/Editor 13.2 or 2025.2
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: Yes
Instructions:
1. Download latest version from Foxit website. 2. Run installer. 3. Restart system after installation.
🔧 Temporary Workarounds
Disable JavaScript in Foxit
windowsPrevents JavaScript execution in PDFs, blocking the exploit vector.
Open Foxit > File > Preferences > JavaScript > Uncheck 'Enable JavaScript'
Use alternative PDF viewer
windowsTemporarily use a different PDF application until patched.
🧯 If You Can't Patch
- Restrict PDF file sources to trusted locations only.
- Implement application whitelisting to block unauthorized PDF execution.
🔍 How to Verify
Check if Vulnerable:
Check Foxit version in Help > About. If version is below 13.2 (for version 13) or below 2025.2 (for 2025), system is vulnerable.Check Version:
In Foxit: Help > AboutVerify Fix Applied:
Confirm version is 13.2 or higher (for version 13) or 2025.2 or higher (for 2025).📡 Detection & Monitoring
Log Indicators:
- Application crashes from Foxit processes
- Unusual JavaScript execution in PDF files
Network Indicators:
- Downloads of PDF files from untrusted sources
SIEM Query:
source="*foxit*" AND (event_type="crash" OR file_type="pdf")