CVE-2025-55310 Overview
CVE-2025-55310 is a code integrity vulnerability affecting Foxit PDF Reader and Foxit PDF Editor for Windows and macOS. The flaw resides in the StartPage feature, which loads static HTML files at application launch. An attacker with local access who can alter or replace these static HTML files can force the application to load malicious content on startup. Successful exploitation may lead to information disclosure, unauthorized data access, and other security impacts. The issue is classified as Download of Code Without Integrity Check [CWE-494] and affects Foxit PDF Reader and Editor for Windows and macOS before version 13.2 and 2025 releases before 2025.2.
Critical Impact
Attackers who tamper with StartPage HTML assets can trigger code execution paths in a trusted PDF application, resulting in high confidentiality, integrity, and availability impact on the affected host.
Affected Products
- Foxit PDF Editor for Windows and macOS before 13.2 and 2025 before 2025.2
- Foxit PDF Reader for Windows and macOS before 13.2 and 2025 before 2025.2
- Deployments on Microsoft Windows and Apple macOS host operating systems
Discovery Timeline
- 2025-12-11 - CVE-2025-55310 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55310
Vulnerability Analysis
The vulnerability originates in the StartPage component of Foxit PDF Reader and Editor. This feature renders a landing view built from static HTML files that ship with the application. Foxit does not verify the integrity of these HTML assets before loading them at startup.
An attacker who can write to the installation directory or the location that stores StartPage assets can replace the HTML with attacker-controlled content. When a user launches the application, the modified page loads in the embedded rendering context. Because the content originates from a trusted local application path, it inherits the privileges and context of the Foxit process. The condition maps to [CWE-494] Download of Code Without Integrity Check.
Root Cause
The root cause is missing integrity validation of local HTML resources consumed by the StartPage feature. The application trusts on-disk files without cryptographic verification, signature checking, or hash comparison. Any writable path used by StartPage becomes a persistence and code-loading channel.
Attack Vector
Exploitation requires local access with privileges sufficient to modify the StartPage HTML files and user interaction to launch the application. An attacker chains a prior foothold, such as a malicious installer, phishing payload, or lateral movement, with modification of the StartPage assets. The next application launch executes the attacker-controlled content and can be used to exfiltrate data, pivot, or maintain persistence.
No verified public proof-of-concept code is available. See the Foxit Security Bulletins for vendor technical details.
Detection Methods for CVE-2025-55310
Indicators of Compromise
- Unexpected modification timestamps on HTML, JavaScript, or CSS files under the Foxit PDF Reader or Editor installation directory
- New or altered files in the StartPage resource path that do not match the vendor-shipped baseline
- Outbound network connections from FoxitPDFReader.exe or FoxitPDFEditor.exe to unfamiliar domains immediately after process start
Detection Strategies
- File integrity monitoring on Foxit installation directories, comparing against known-good hashes from a clean install of version 13.2 or 2025.2
- Endpoint telemetry rules that flag non-installer processes writing to Foxit application resource paths
- Process ancestry rules that alert when Foxit processes spawn scripting hosts, shells, or perform unusual network activity at launch
Monitoring Recommendations
- Baseline Foxit binaries and static assets after patching and audit changes on a scheduled basis
- Correlate user logon events with Foxit application starts and outbound HTTP or WebSocket connections
- Track privileged writes to Program Files\Foxit Software\ on Windows and /Applications/Foxit PDF*.app/ on macOS
How to Mitigate CVE-2025-55310
Immediate Actions Required
- Upgrade Foxit PDF Reader and Foxit PDF Editor to version 13.2 or later, or to the 2025.2 release on the 2025 branch
- Restrict write permissions on the Foxit installation directory to administrators only
- Audit endpoints for unauthorized modifications to StartPage HTML assets and restore vendor originals where tampering is found
Patch Information
Foxit has released fixed versions that address CVE-2025-55310. Upgrade to Foxit PDF Reader and Editor 13.2 or 2025.2 on both Windows and macOS. Refer to the Foxit Security Bulletins for the full advisory and download links.
Workarounds
- Enforce least-privilege configurations so standard users cannot modify files in the Foxit installation path
- Deploy application allowlisting to prevent unauthorized processes from writing to Foxit directories
- Disable or hide the StartPage feature through group policy or configuration where the vendor supports it, until patching is complete
# Windows: harden ACLs on the Foxit installation directory
icacls "C:\Program Files\Foxit Software\Foxit PDF Editor" /inheritance:r
icacls "C:\Program Files\Foxit Software\Foxit PDF Editor" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
# macOS: verify ownership and permissions on the application bundle
sudo chown -R root:wheel "/Applications/Foxit PDF Editor.app"
sudo chmod -R go-w "/Applications/Foxit PDF Editor.app"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
