High · published December 11, 2025
⚡ A sneaky JavaScript quirk in Foxit PDF could lead to chaos! If pages are deleted, the app might just forget what it was doing, paving the way for crashes or even arbitrary code execution! 🔥 Think of it like a restaurant forgetting your special order after you've made changes to your meal deal. When the kitchen assumes everything is fine, they might serve you something completely unexpected – and possibly dangerous! An attacker could exploit this vulnerability to corrupt memory, crash the application, or run their own malicious code on your system. This could lead to data loss or further exploitation of your device, making it a significant threat that you don't want to ignore!
Think of it like a restaurant forgetting your special order after you've made changes to your meal deal. When the kitchen assumes everything is fine, they might serve you something completely unexpected – and possibly dangerous! This vulnerability arises when JavaScript manipulates PDF pages, not updating internal states correctly, resulting in dereferencing invalid or released memory. This mismanagement opens the door for potential code execution.
An attacker could exploit this vulnerability to corrupt memory, crash the application, or run their own malicious code on your system. This could lead to data loss or further exploitation of your device, making it a significant threat that you don't want to ignore! Make sure to update your Foxit PDF and Editor to version 13.2 or 2025.2 at the very latest. Regularly audit your JavaScript usage in PDFs and implement strict input validation to catch any malicious scripts. 🛡️ You've got this! By following these steps, you'll keep your PDF operations safe and sound. 🌟
| Product | Versions | Fixed in |
|---|---|---|
| foxit/pdf_editor | ≤ 13.1.7.23637 | — |
| foxit/pdf_editor | ≥ 2023.1.0.15510, ≤ 2023.3.0.23028 | — |
| foxit/pdf_editor | ≥ 2024.1.0.23997, ≤ 2024.4.1.27687 | — |
| foxit/pdf_editor | all versions | — |
| foxit/pdf_reader | ≤ 2025.1.0.27937 | — |