CVE-2025-9323
📋 TL;DR
This vulnerability in Foxit PDF Reader allows remote attackers to disclose sensitive information by tricking users into opening malicious JP2 files. The flaw exists in JP2 file parsing where improper data validation enables out-of-bounds reads. Affected users include anyone running vulnerable versions of Foxit PDF Reader.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure combined with other vulnerabilities could lead to arbitrary code execution in the current process context.
Likely Case
Sensitive memory content disclosure, potentially revealing credentials, session data, or other confidential information.
If Mitigated
Limited information leakage without code execution if proper memory protections are in place.
🎯 Exploit Status
Requires user interaction (opening malicious file). Combined with other vulnerabilities for code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest version from Foxit (check vendor advisory)
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: No
Instructions:
1. Visit Foxit's security bulletins page. 2. Download and install the latest version. 3. Verify installation completes successfully.
🔧 Temporary Workarounds
Disable JP2 file support
allRemove or disable JP2 file format handling in Foxit PDF Reader
Use alternative PDF viewer
allTemporarily use a different PDF reader until patched
🧯 If You Can't Patch
- Implement application whitelisting to block Foxit PDF Reader execution
- Use email/web gateways to block JP2 file attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check Foxit PDF Reader version against vendor advisory. Versions prior to patch are vulnerable.Check Version:
In Foxit PDF Reader: Help → About Foxit ReaderVerify Fix Applied:
Verify Foxit PDF Reader version matches or exceeds patched version from vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Foxit PDF Reader crash logs
- Application error events related to JP2 parsing
Network Indicators:
- Downloads of JP2 files followed by Foxit PDF Reader execution
SIEM Query:
Process:foxitreader.exe AND FileExtension:.jp2 OR FileExtension:.j2k