CVE-2025-66499CWE-190

Foxit PDF Reader PDF Parsing Heap-Based Buffer Overflow Remote Code Execution Vulnerability

High · published December 19, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

⚡ A crafty heap-based buffer overflow in Foxit PDF Reader could let attackers run rogue code simply by sending a specially crafted PDF. Don't underestimate the sneaky potential of JBIG2 data! 🔥 Think of this like a delivery truck loaded with boxes that were too big for the back — they might spill out and cause chaos on the road. Similarly, the overflow in the image buffer can lead to unexpected behaviors, just like that messy spill! An attacker could exploit this vulnerability to execute arbitrary code on a victim's machine, potentially giving them control over the system. Imagine an uninvited guest taking over your home — that’s how serious this can be. It might lead to data breaches or further compromise of your network!

Put simply

Think of this like a delivery truck loaded with boxes that were too big for the back — they might spill out and cause chaos on the road. Similarly, the overflow in the image buffer can lead to unexpected behaviors, just like that messy spill! This vulnerability stems from an integer overflow during the PDF parsing process when handling crafted JBIG2 data, resulting in a heap-based buffer overflow that attackers can exploit to run malicious code.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on a victim's machine, potentially giving them control over the system. Imagine an uninvited guest taking over your home — that’s how serious this can be. It might lead to data breaches or further compromise of your network! Update Foxit PDF Reader to the latest version immediately to patch this vulnerability. Consider implementing additional security measures such as using antivirus solutions that can scan PDF files. Regularly review and manage permissions for PDF files to minimize risk. You've got this! By following these steps, you're one step closer to being the hero of your own security story! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2025-12-19T07:11Z
EPSS history
Timeline
  • 19 DEC 07:11Z
    Foxit PDF Reader PDF Parsing Heap-Based Buffer Overflow Remote Code Execution Vulnerability
    cvelistv5