CVE-2025-9323: Foxit PDF Editor JP2 File Parsing Vulnerability

CVE-2025-9323 Overview

CVE-2025-9323 is an out-of-bounds read vulnerability [CWE-125] in Foxit PDF Reader and Foxit PDF Editor on Microsoft Windows. The flaw resides in the parsing logic for JPEG 2000 (JP2) image files embedded in PDF documents. Attackers can craft malicious JP2 streams that cause the parser to read memory past the end of an allocated object, exposing sensitive process memory. Exploitation requires user interaction, specifically opening a malicious file or visiting a page that delivers one. The Zero Day Initiative tracked the issue as ZDI-CAN-27101 and published advisory ZDI-25-869.

Critical Impact
Attackers can disclose sensitive in-process memory and chain the leak with other vulnerabilities to achieve arbitrary code execution in the context of the Foxit process.

Affected Products

Foxit PDF Reader on Microsoft Windows
Foxit PDF Editor (including version 2025.1.0.27937) on Microsoft Windows
Microsoft Windows installations hosting vulnerable Foxit builds

Discovery Timeline

2025-09-02 - CVE-2025-9323 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9323

Vulnerability Analysis

The vulnerability exists in the JP2 (JPEG 2000) file parser used by Foxit PDF Reader and Foxit PDF Editor. The parser fails to properly validate user-supplied length or offset fields embedded in the JP2 stream. When processing a malformed JP2 object, the component reads memory beyond the boundary of the allocated buffer. The read operation exposes adjacent heap data to the application's control flow, where it can be reflected back through subsequent rendering or scripting primitives inside the PDF document.

An attacker who controls the malicious document can combine this read primitive with a separate memory corruption bug to defeat Address Space Layout Randomization (ASLR) and reach arbitrary code execution. On its own, the issue produces an information disclosure impact rather than direct code execution.

Root Cause

The root cause is missing bounds validation on fields parsed from untrusted JP2 image data. The parser trusts attacker-controlled size and offset values when iterating over the embedded image structure. This matches the classification CWE-125: Out-of-bounds Read. Any PDF file containing a crafted JP2 object can trigger the condition during normal document rendering.

Attack Vector

The attack vector is local and requires user interaction. A target must open a weaponized PDF or navigate to a page that automatically loads one through the Foxit browser plugin. No elevated privileges are required to trigger the parser path. Attackers typically deliver the file through phishing emails, drive-by downloads, or shared document platforms.

No verified public exploit code is available. See the Zero Day Initiative Advisory ZDI-25-869 for the technical reference used to track this issue.

Detection Methods for CVE-2025-9323

Indicators of Compromise

PDF documents containing embedded JP2 image streams with malformed or oversized length fields that fail standard JPEG 2000 validation.
Unexpected crashes or memory access violations in FoxitPDFReader.exe or FoxitPDFEditor.exe processes shortly after opening a document.
Inbound email attachments or downloads delivering PDFs from untrusted senders that reference JP2 objects in their object dictionary.

Detection Strategies

Inspect PDF attachments at the mail gateway for embedded JP2 (/Filter /JPXDecode) streams and sandbox-detonate suspicious samples.
Correlate Foxit process crash telemetry with recent file-open events to identify exploitation attempts against unpatched clients.
Hunt for anomalous child processes or outbound connections originating from Foxit PDF Reader after a document is opened.

Monitoring Recommendations

Enable endpoint telemetry on FoxitPDFReader.exe and FoxitPDFEditor.exe for module loads, memory faults, and script execution.
Monitor Windows Error Reporting (WER) entries referencing access violations in Foxit image-decoding modules.
Track versions of Foxit PDF Reader and Editor deployed across the fleet to confirm patch coverage against the fixed release.

How to Mitigate CVE-2025-9323

Immediate Actions Required

Update Foxit PDF Reader and Foxit PDF Editor to the version listed in the vendor advisory that addresses ZDI-CAN-27101.
Restrict Foxit from acting as the default handler for PDF files delivered from untrusted sources until patching is complete.
Train users to avoid opening unexpected PDF attachments and to report suspicious documents to the security team.

Patch Information

Foxit has published guidance in the Foxit Security Bulletins. Administrators should apply the latest fixed release of Foxit PDF Reader and Foxit PDF Editor on all Windows endpoints. Confirm that build numbers exceed the vulnerable 2025.1.0.27937 release referenced in the CPE data.

Workarounds

Disable the Foxit browser plugin to prevent automatic rendering of PDF content from web pages.
Enable Safe Reading Mode in Foxit to restrict execution of embedded actions and scripts within documents.
Route inbound PDF attachments through a content disarm and reconstruction (CDR) pipeline that strips or re-encodes embedded JP2 streams.

bash

# Configuration example: disable Foxit browser integration via registry on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\Plugins" /v "bBrowserIntegration" /t REG_DWORD /d 0 /f

# Enforce Safe Reading Mode
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\Trust Manager" /v "bEnableSafeReading" /t REG_DWORD /d 1 /f