CVE-2025-9325 Overview
CVE-2025-9325 is an out-of-bounds read vulnerability [CWE-125] in Foxit PDF Reader and Foxit PDF Editor. The flaw resides in the parser that processes Product Representation Compact (PRC) files embedded within PDF documents. Insufficient validation of user-supplied data allows a read past the end of an allocated object, exposing adjacent process memory. Exploitation requires user interaction: the target must open a crafted PDF or visit a page hosting one. An attacker can pair this issue with other vulnerabilities to achieve arbitrary code execution in the context of the current process. The Zero Day Initiative tracked the finding as ZDI-CAN-26785.
Critical Impact
Attackers can disclose sensitive process memory through a malicious PRC-embedded PDF, providing a primitive that can be chained with other bugs to execute code.
Affected Products
- Foxit PDF Reader (Windows and macOS)
- Foxit PDF Editor versions including 2025.1.0.27937 and 2025.1.0.66692
- Microsoft Windows and Apple macOS host platforms
Discovery Timeline
- 2025-09-02 - CVE-2025-9325 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-9325
Vulnerability Analysis
The vulnerability affects Foxit's PRC file parser. PRC is a 3D content format that Foxit PDF Reader and Editor process when a PDF embeds a 3D annotation. The parser reads structured records from the PRC stream and copies fields into allocated buffers based on length values contained in the file itself.
Because the parser does not properly validate these length or offset values against the actual buffer size, a crafted PRC stream can force the reader to read data beyond the end of an allocated object. The disclosed memory can include heap metadata, object pointers, or content from prior allocations.
On its own, the flaw leaks information from the current process. When combined with a memory corruption primitive, the leaked pointers can defeat Address Space Layout Randomization (ASLR) and enable arbitrary code execution under the identity of the user running Foxit.
Root Cause
The root cause is missing bounds validation on attacker-controlled size or index fields during PRC record parsing. The parser trusts values embedded in the file and uses them to compute read offsets without verifying they remain within the allocated buffer.
Attack Vector
Exploitation requires the victim to open a malicious PDF containing a crafted PRC stream, either from disk or via a browser plugin that renders PDFs through Foxit. No authentication is required, but user interaction is mandatory.
Refer to the ZDI Advisory ZDI-25-867 for additional technical context.
Detection Methods for CVE-2025-9325
Indicators of Compromise
- PDF files containing 3D annotations with embedded PRC streams from untrusted sources or unexpected senders.
- Foxit Reader or Editor processes crashing or generating Windows Error Reporting entries after opening a PDF.
- Outbound network connections initiated by FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after document open.
Detection Strategies
- Inspect email and web gateway traffic for PDF attachments referencing PRC or 3D annotation dictionaries such as /3D and /RichMedia.
- Monitor endpoints for anomalous child processes spawned by Foxit binaries, which may indicate exploit chaining.
- Correlate PDF open events with unusual heap access patterns or crash telemetry originating from Foxit modules.
Monitoring Recommendations
- Enable process and file telemetry for Foxit installations across Windows and macOS endpoints.
- Alert on Foxit processes writing executables or scripts to disk in user-writable paths.
- Track versioning of installed Foxit products to identify hosts still running vulnerable builds.
How to Mitigate CVE-2025-9325
Immediate Actions Required
- Inventory all endpoints running Foxit PDF Reader and Foxit PDF Editor and identify vulnerable builds including 2025.1.0.27937 and 2025.1.0.66692.
- Apply the vendor update referenced in the Foxit Security Bulletins as soon as it is available in your change window.
- Instruct users to avoid opening PDF files from untrusted sources until patching completes.
Patch Information
Foxit publishes fixed versions and remediation guidance on the Foxit Security Bulletins page. Administrators should deploy the latest patched builds of Foxit PDF Reader and Foxit PDF Editor for both Windows and macOS platforms and verify installed versions after deployment.
Workarounds
- Disable the 3D content plugin within Foxit PDF Reader and Editor preferences to prevent PRC parsing.
- Block PDF attachments containing 3D annotations at email and web gateways where feasible.
- Configure the operating system to open PDFs in a sandboxed viewer for high-risk user populations until patches are applied.
# Windows: query installed Foxit versions to identify vulnerable hosts
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Foxit"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
