CVE-2025-55307CWE-125

CVE-2025-55307

Low · published December 11, 2025

CVSS v3.1

3.3

EPSS

Percentile

7.1

In the wild

Unconfirmed

What it is

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption.

The record

Technical detail

CVSS v3.1: 3.3 · LOW
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00180 · 7.1th percentile
Weakness: CWE-125 · Out-of-bounds Read
Published: 2025-12-11T21:16Z

Affected products (5)

Product	Versions	Fixed in
foxit/pdf_editor	≤ 13.1.7.23637	—
foxit/pdf_editor	≥ 2023.1.0.15510, ≤ 2023.3.0.23028	—
foxit/pdf_editor	≥ 2024.1.0.23997, ≤ 2024.4.1.27687	—
foxit/pdf_editor	all versions	—
foxit/pdf_reader	≤ 2025.1.0.27937	—

References (1)

https://www.foxit.com/support/security-bulletins.html · [email protected]

EPSS history

Timeline

11 DEC 00:00Z
An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2
cvelistv5