CVE-2025-13941
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-19

Last updated on: 2025-12-23

Assigner: Foxit

Description
A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-19
Last Modified
2025-12-23
Generated
2026-06-16
AI Q&A
2025-12-19
EPSS Evaluated
2026-06-14
NVD
CVE-2025-13941
EUVD
EUVD-2025-204428
Affected Vendors & Products
Showing 7 associated CPEs
Vendor Product Version / Range
foxit pdf_editor to 13.2.1.23955 (inc)
foxit pdf_editor From 14.0.0.33046 (inc) to 14.0.1.33197 (inc)
foxit pdf_editor From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit pdf_editor From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit pdf_editor From 2025.1.0.27937 (inc) to 2025.2.1.33197 (inc)
foxit pdf_reader to 2025.2.1.33197 (inc)
microsoft windows *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a local privilege escalation issue in the Foxit PDF Reader/Editor Update Service. It occurs because the update service assigns incorrect file system permissions to resources during plugin installation. A local attacker with low privileges can modify or replace these resources, which the service later executes, allowing the attacker to run arbitrary code with SYSTEM-level privileges.

Impact Analysis

This vulnerability can allow a local attacker with limited privileges to escalate their rights to SYSTEM level, potentially gaining full control over the affected system. This could lead to unauthorized code execution, data compromise, or disruption of system operations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13941. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart