CVE-2025-59803: Foxit PDF Editor XSS Vulnerability

CVE-2025-59803 Overview

CVE-2025-59803 is a signature spoofing vulnerability affecting Foxit PDF Editor and Foxit PDF Reader before version 2025.2.1. The flaw allows attackers to embed triggers such as JavaScript inside a PDF document that execute during the signing process. When the signer previews the file, content appears normal. Once the signature is applied, the embedded triggers modify content on other pages or optional content layers without any warning to the signer. The result is a signed PDF that differs from what the signer reviewed, undermining the integrity guarantees of digital signatures [CWE-347]. Fixed versions are 2025.2.1, 14.0.1, and 13.2.1.

Critical Impact
A signer may unknowingly apply a valid digital signature to a document whose visible content has been altered by embedded triggers, breaking non-repudiation for contracts, legal filings, and financial documents.

Affected Products

Foxit PDF Editor before 2025.2.1, 14.0.1, and 13.2.1 (Windows and macOS)
Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 (Windows and macOS)
Deployments relying on Foxit-produced signatures for document authenticity

Discovery Timeline

2025-12-11 - CVE-2025-59803 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59803

Vulnerability Analysis

The vulnerability lies in how Foxit PDF Editor and Reader handle document triggers during the signing workflow. PDF specifications allow actions such as JavaScript to execute in response to document events including page open, document save, and signature application. Foxit processes these triggers without isolating them from the signing pipeline. An attacker crafts a PDF whose visible content appears benign at review time. Embedded trigger actions fire when the signature is applied, mutating content on unrelated pages or toggling optional content group (OCG) layers so that different text or images render after signing. Because the modifications occur before the signature hash is computed over the final byte range, the resulting signature validates as cryptographically intact even though the visible content no longer matches what the signer approved.

Root Cause

The root cause is improper verification of cryptographic signature integrity relative to user-visible content [CWE-347]. Foxit permits trigger-driven content mutations to occur inside the same transaction as signature application, and does not warn the user when such triggers exist in the document being signed. The signing UI presents a static rendering that does not reflect post-trigger state.

Attack Vector

Exploitation requires the attacker to deliver a malicious PDF to a target who signs it in a vulnerable Foxit build. The attack surface is network-reachable through email attachments, document workflow platforms, or shared storage. User interaction is required because a signer must open and sign the file. The impact is limited to integrity of the signed document, with no direct code execution or data disclosure. A successful attack yields a validly signed PDF whose displayed content differs from what the signer reviewed, useful for fraud in contracts, invoices, and regulated document workflows.

No verified public proof-of-concept code has been released. Refer to the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2025-59803

Indicators of Compromise

Signed PDFs containing /AA (Additional Actions), /OpenAction, or JavaScript /JS entries that reference pages or OCG layers outside the visible signature area.
Discrepancies between the pre-signature rendering and the post-signature rendering of the same document when opened in an unaffected viewer.
Signed documents whose byte range spans dynamic content areas modified by embedded scripts.

Detection Strategies

Parse incoming PDFs at the mail or content gateway and flag documents that combine signature fields with JavaScript actions or optional content layer toggles.
Compare hashes of the visible content stream before and after applying a test signature in a sandbox to identify trigger-driven mutation.
Validate signed PDFs with an independent verifier that renders both the signed byte range and the fully evaluated document to expose divergence.

Monitoring Recommendations

Log signing events from Foxit clients and correlate with the presence of JavaScript or additional actions in the source PDF.
Alert on Foxit PDF Editor or Reader versions below 2025.2.1, 14.0.1, and 13.2.1 reporting from endpoints in signing-heavy business units.
Monitor document management systems for signed PDFs containing OCG toggles or dynamic form actions.

How to Mitigate CVE-2025-59803

Immediate Actions Required

Upgrade Foxit PDF Editor and Foxit PDF Reader to 2025.2.1, 14.0.1, or 13.2.1 on all Windows and macOS endpoints.
Inventory endpoints running vulnerable Foxit builds and prioritize upgrades for users who routinely sign contracts, legal, or financial documents.
Instruct signers to open unfamiliar PDFs in a viewer with JavaScript disabled before applying a signature.

Patch Information

Foxit has released fixed builds 2025.2.1, 14.0.1, and 13.2.1 for both PDF Editor and PDF Reader. Refer to the Foxit Security Bulletins for download links and full release notes.

Workarounds

Disable JavaScript execution in Foxit PDF Editor and Reader under Preferences > JavaScript until patched builds are deployed.
Reject or quarantine incoming PDFs that contain /AA, /OpenAction, or /JS entries at the email or content gateway when signing workflows are involved.
Require counter-verification of signed PDFs using an independent PDF validator that renders the fully evaluated document for comparison against the signer's approved copy.

bash

# Example: flag PDFs containing JavaScript or additional actions before signing
grep -aE '/JS|/AA|/OpenAction|/JavaScript' suspicious.pdf && \
  echo "PDF contains signing-time triggers - do not sign in vulnerable Foxit builds"