CVE-2025-55311: Foxit PDF Editor Auth Bypass Vulnerability

CVE-2025-55311 Overview

CVE-2025-55311 affects Foxit PDF Reader and Foxit PDF Editor for Windows and macOS. A crafted PDF can invoke JavaScript to alter annotation content and then clear the file's modification status through JavaScript interfaces. This sequence bypasses digital signature verification by hiding evidence that the document was changed after signing. An attacker can mislead recipients into trusting a modified document that appears cryptographically intact. The flaw maps to CWE-347 — Improper Verification of Cryptographic Signature.

Critical Impact
Attackers can silently modify signed PDFs while preserving the appearance of a valid digital signature, undermining document integrity in contract, legal, and financial workflows.

Affected Products

Foxit PDF Editor for Windows and macOS before 13.2 and 2025 before 2025.2
Foxit PDF Reader for Windows and macOS before 13.2 and 2025 before 2025.2
Deployments on Microsoft Windows and Apple macOS host operating systems

Discovery Timeline

2025-12-11 - CVE-2025-55311 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55311

Vulnerability Analysis

The vulnerability resides in how Foxit PDF products track document modification state when JavaScript modifies annotation objects. A crafted PDF uses embedded JavaScript to change annotation content — text, comments, or overlay objects — after the document has been digitally signed. The same script then clears the dirty flag that would normally invalidate the signature check, causing the application to report the document as unmodified. Because signature verification in the client trusts this internal state rather than recomputing a hash across the changed annotation stream, the modified PDF continues to display as signed and unaltered. The result is a signature bypass that does not require breaking any cryptographic primitive.

Root Cause

The root cause is improper verification of cryptographic signature state ([CWE-347]). Foxit's JavaScript interfaces expose functions that reset or suppress the modification indicator without triggering a full re-verification of the signed byte ranges. Signature validity is derived from cached state instead of the current document content.

Attack Vector

Exploitation requires a victim to open a specially crafted PDF in a vulnerable Foxit build. The attacker controls the JavaScript embedded in the file and can pre-stage annotation modifications that execute when the document loads or when the user interacts with a specific element. No authentication or elevated privileges are needed on the target system, and the attack works over any delivery channel that transfers PDFs, including email, web download, and file share.

No public proof-of-concept or exploit code has been released for CVE-2025-55311 at the time of publication. See the Foxit Security Bulletins for vendor-provided technical detail.

Detection Methods for CVE-2025-55311

Indicators of Compromise

PDF files containing JavaScript that calls annotation modification APIs followed by calls that reset the document dirty or modification flag.
Signed PDFs where annotation streams show byte ranges outside the signed /ByteRange region yet the client reports the signature as valid.
Inbound PDFs from external senders that combine embedded JavaScript with visible digital signatures on high-value document types such as contracts or invoices.

Detection Strategies

Perform out-of-band signature verification using a second PDF validator or command-line tool such as pdfsig to compare results against Foxit's reported status.
Statically scan PDFs at the mail gateway for JavaScript actions that touch annotation objects in signed documents and quarantine matches for review.
Hunt for Foxit process executions that open PDFs from untrusted paths shortly before user actions on financial or legal workflows.

Monitoring Recommendations

Log and alert on Foxit PDF Reader and Editor process launches with command-line arguments referencing files from email attachment or browser download directories.
Monitor endpoints for outdated Foxit versions below 13.2 or 2025.2 using existing software inventory tooling.
Track document workflow systems for post-signing modifications that do not correspond to a re-signing event.

How to Mitigate CVE-2025-55311

Immediate Actions Required

Upgrade Foxit PDF Editor and Foxit PDF Reader to version 13.2 or later, or to 2025.2 or later, on all Windows and macOS endpoints.
Inventory all installations of Foxit products and prioritize systems used by legal, finance, and executive staff who routinely handle signed PDFs.
Instruct users to treat digital signature indicators on PDFs as advisory until patching is confirmed across the fleet.

Patch Information

Foxit has released fixed builds addressing CVE-2025-55311. Refer to the Foxit Security Bulletins for the specific patched version applicable to each product line and platform. Deploy through standard software distribution channels and verify version strings post-install.

Workarounds

Disable JavaScript execution in Foxit PDF Reader and Editor via Preferences → JavaScript → Enable JavaScript Actions until patches are deployed.
Route inbound PDFs through a sanitization or content disarm and reconstruction pipeline that strips embedded JavaScript before delivery.
Require a second independent signature verification tool for any signed PDF used in a legally binding process.

bash

# Verify a signed PDF outside of Foxit using poppler-utils
pdfsig /path/to/signed_document.pdf

# Detect embedded JavaScript in incoming PDFs
pdfid.py /path/to/incoming.pdf | grep -E "/JS|/JavaScript|/AA|/OpenAction"