CVE-2025-55312: Foxit PDF Editor RCE Vulnerability

CVE-2025-55312 Overview

CVE-2025-55312 is a memory corruption vulnerability in Foxit PDF Reader and Foxit PDF Editor for Windows and macOS. The flaw exists in versions prior to 13.2 and 2025 versions before 2025.2. When JavaScript embedded in a PDF deletes pages, the application fails to update internal state correctly. Subsequent annotation management operations then dereference invalid or freed memory. This null pointer dereference [CWE-476] can lead to application crashes and potentially arbitrary code execution in the context of the user.

Critical Impact
A crafted PDF document can trigger memory corruption in Foxit PDF Reader and Editor, allowing attackers to execute arbitrary code when a user opens the file.

Affected Products

Foxit PDF Editor for Windows and macOS before version 13.2
Foxit PDF Editor 2025 before version 2025.2
Foxit PDF Reader (corresponding versions on Windows and macOS)

Discovery Timeline

2025-12-11 - CVE-2025-55312 published to the National Vulnerability Database
2025-12-18 - Last updated in NVD database

Technical Details for CVE-2025-55312

Vulnerability Analysis

The vulnerability resides in the page lifecycle and annotation subsystem of Foxit PDF Reader and Editor. Foxit exposes a JavaScript API that lets PDF documents script document operations, including page deletion. When pages are removed through this API, the application does not consistently update the internal data structures that track annotations and page references.

Later operations that manage annotations assume these internal pointers remain valid. The code dereferences pointers that now reference released or invalid memory regions. This produces a null pointer dereference or use-after-free style condition, depending on heap state at the time of the call.

An attacker who controls the dangling memory contents can convert the crash into arbitrary code execution. Because the affected process runs with the privileges of the user opening the document, successful exploitation grants those same privileges.

Root Cause

The root cause is improper state synchronization between the JavaScript-driven page removal path and the annotation management path [CWE-476]. The deletion routine releases backing objects without invalidating or removing references held by annotation handlers. Subsequent calls operate on stale references.

Attack Vector

Exploitation requires a victim to open a malicious PDF document in a vulnerable Foxit build. The crafted document contains JavaScript that programmatically deletes pages, then triggers annotation operations that touch the now-invalid state. Common delivery methods include phishing email attachments, drive-by downloads, and shared cloud storage.

The attack vector is local with user interaction required, but the social engineering bar is low because PDF files are routinely opened in business environments.

No public proof-of-concept code is currently available. See the Foxit Security Bulletin for vendor technical details.

Detection Methods for CVE-2025-55312

Indicators of Compromise

Foxit PDF Reader or Editor processes (FoxitPDFReader.exe, FoxitPDFEditor.exe) crashing with access violation exceptions shortly after opening a document
PDF files containing JavaScript that calls doc.deletePages() followed by annotation manipulation APIs such as addAnnot, getAnnots, or removeAnnot
Unexpected child processes spawned by the Foxit application following a document open event

Detection Strategies

Inspect inbound PDF attachments for embedded JavaScript that combines page deletion with annotation operations using static PDF parsers
Monitor endpoints for Windows Error Reporting (WER) crash dumps referencing Foxit modules and exception codes such as 0xC0000005
Correlate process creation events where Foxit binaries spawn cmd.exe, powershell.exe, rundll32.exe, or other living-off-the-land binaries

Monitoring Recommendations

Enable command-line and process-creation auditing on endpoints running Foxit products
Forward PDF reader crash telemetry and child-process events to a centralized SIEM or data lake for correlation
Track Foxit product versions across the fleet through software inventory tooling and alert on hosts still running pre-13.2 or pre-2025.2 builds

How to Mitigate CVE-2025-55312

Immediate Actions Required

Upgrade Foxit PDF Editor and Reader to version 13.2 or later, or to 2025.2 or later on all Windows and macOS endpoints
Inventory all installations of Foxit PDF Reader and Editor and prioritize patching on systems that regularly handle external PDFs
Warn users to avoid opening PDF documents from untrusted senders until patching completes

Patch Information

Foxit has released fixed versions addressing CVE-2025-55312. Apply Foxit PDF Editor and Reader 13.2 or the 2025.2 release as documented in the Foxit Security Bulletin. Verify version numbers after deployment to confirm the patch is in place.

Workarounds

Disable JavaScript execution in Foxit PDF Reader and Editor via Preferences > JavaScript > Enable JavaScript Actions until patches are deployed
Route inbound PDF attachments through a sandbox or content disarm and reconstruction (CDR) gateway that strips embedded JavaScript
Apply application allowlisting to restrict child-process creation by Foxit binaries

bash

# Group Policy registry example to disable JavaScript in Foxit PDF Editor on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f