CVE-2025-66494CWE-416

Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability

High · published December 19, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

⚡ A single flawed PDF object could lead to trouble! The use-after-free vulnerability in Foxit PDF Reader allows remote attackers to run arbitrary code before version 2025.2.1, 14.0.1, or 13.2.1. 🔥 Think of it like a library where a book has been checked out but is still listed on the shelf. If someone tries to borrow that book while it's already gone, they might get handed a completely different, unexpected tome instead—potentially dangerous! An attacker can exploit this flaw to run any code they want on your system, opening the door to a world of possibilities for malicious actions, from stealing information to spreading malware. If you're using an affected version, this could mean the difference between a smooth document review and complete chaos!

Put simply

Think of it like a library where a book has been checked out but is still listed on the shelf. If someone tries to borrow that book while it's already gone, they might get handed a completely different, unexpected tome instead—potentially dangerous! This use-after-free vulnerability allows a PDF object managed by multiple parents to be freed while still being referenced. This can lead to arbitrary code execution when a remote attacker crafts a malicious PDF file.

What to do

An attacker can exploit this flaw to run any code they want on your system, opening the door to a world of possibilities for malicious actions, from stealing information to spreading malware. If you're using an affected version, this could mean the difference between a smooth document review and complete chaos! Update Foxit PDF Reader to version 2025.2.1, 14.0.1, or 13.2.1 immediately to patch this vulnerability. Additionally, monitor your PDF handling practices and educate users about only opening trusted files. 🛡️ You've got this! Follow these steps and you'll keep your documents and data safe. ✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-19T07:08Z
EPSS history
Timeline
  • 19 DEC 07:08Z
    Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability
    cvelistv5