BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-12

Assigner: MITRE

Description

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-11

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-12-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-55307

EUVD

EUVD-2025-202691

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_and_editor	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Foxit PDF and Editor for Windows before versions 13.2 and 2025 before 2025.2. When opening a malicious PDF that contains a specially crafted JavaScript call to search.query() with a crafted cDIPath parameter, it may cause an out-of-bounds read in the internal path-parsing logic. This means the program reads memory outside the intended bounds, which can lead to unintended behavior.

Impact Analysis

The impact of this vulnerability includes potential information disclosure or memory corruption. Information disclosure means that sensitive data could be exposed to an attacker. Memory corruption could lead to crashes or potentially allow an attacker to execute arbitrary code.

Hi! I’m here to help you understand CVE-2025-55307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70