CVE-2025-66495CWE-416

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

High · published December 19, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

⚡ This use-after-free vulnerability in Foxit PDF Reader means code execution could be just a crafty PDF away! 📄💥 Think of it like a restaurant that leaves the door to the kitchen unlocked even after closing time. A malicious PDF can let attackers sneak in and cook up something dangerous using old, forgotten ingredients still lying around — just waiting for the wrong hands! If exploited, this vulnerability could give attackers the keys to your system, allowing them to run arbitrary code. This could lead to anything from data theft to complete system takeover — it's a serious risk that you don't want to ignore!

Put simply

Think of it like a restaurant that leaves the door to the kitchen unlocked even after closing time. A malicious PDF can let attackers sneak in and cook up something dangerous using old, forgotten ingredients still lying around — just waiting for the wrong hands! This use-after-free vulnerability allows an attacker to access memory that has already been released, specifically through crafted JavaScript in a PDF file. When Foxit PDF Reader fails to properly manage memory, it inadvertently opens a door for potential exploits.

What to do

If exploited, this vulnerability could give attackers the keys to your system, allowing them to run arbitrary code. This could lead to anything from data theft to complete system takeover — it's a serious risk that you don't want to ignore! To protect yourself, update Foxit PDF Reader to version 2025.2.1, 14.0.1, or 13.2.1 immediately. Additionally, be cautious when opening PDFs from untrusted sources and consider enabling scripts only for known safe documents. You've got this! Secure your PDF Reader and keep those pesky attackers at bay! 🛡️✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-19T07:09Z
EPSS history
Timeline
  • 19 DEC 07:09Z
    Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
    cvelistv5