CVE-2025-9324
📋 TL;DR
Foxit PDF Reader contains an out-of-bounds read vulnerability when parsing PRC files, allowing attackers to disclose sensitive information from affected systems. This affects users who open malicious PDF files or visit compromised websites. User interaction is required for exploitation.
💻 Affected Systems
- Foxit PDF Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure combined with other vulnerabilities could lead to arbitrary code execution in the current process context.
Likely Case
Sensitive memory contents disclosure, potentially revealing credentials, session data, or other confidential information.
If Mitigated
Limited information leakage without code execution if proper memory protections are in place.
🎯 Exploit Status
Requires user interaction to open malicious file. Information disclosure alone may need chaining with other vulnerabilities for full compromise.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Foxit security bulletin for latest patched version
Vendor Advisory: https://www.foxit.com/support/security-bulletins.html
Restart Required: No
Instructions:
1. Visit Foxit security bulletins page 2. Identify affected version range 3. Update to latest version 4. Verify update completed successfully
🔧 Temporary Workarounds
Disable PRC file parsing
allConfigure Foxit Reader to disable PRC/3D content rendering if not required
Navigate to Edit > Preferences > 3D & Multimedia > Uncheck 'Enable 3D content'
Use alternative PDF viewer
allTemporarily use different PDF software until patched
🧯 If You Can't Patch
- Restrict user permissions to limit impact of information disclosure
- Implement application whitelisting to prevent unauthorized PDF readers
🔍 How to Verify
Check if Vulnerable:
Check Foxit Reader version against vendor advisory. Versions listed as vulnerable in ZDI-25-868 or Foxit bulletin are affected.Check Version:
In Foxit Reader: Help > About Foxit ReaderVerify Fix Applied:
Verify Foxit Reader version is updated beyond vulnerable versions listed in advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening PDF files
- Unexpected memory access errors in application logs
Network Indicators:
- Downloads of PDF files from untrusted sources
- Network traffic to known malicious domains delivering PDFs
SIEM Query:
EventID for application crashes OR process creation for foxit reader with suspicious parent process