CVE-2025-55308
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-12

Assigner: MITRE

Description
An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that calls closeDoc() while internal objects are still in use can cause premature release of these objects. This use-after-free vulnerability may lead to memory corruption, potentially resulting in information disclosure when the PDF is opened.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-11
Last Modified
2025-12-12
Generated
2026-06-16
AI Q&A
2025-12-11
EPSS Evaluated
2026-06-14
NVD
CVE-2025-55308
EUVD
EUVD-2025-202711
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
foxit pdf_editor 2024.2.3.25184
foxit pdf_reader 2024.2.3.25184
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, users should update their Foxit PDF Reader and Editor applications to the latest versions. Updates can be obtained through the application's built-in update feature or by downloading the latest versions from the Foxit website. [1]

Mitigation Strategies

To mitigate this vulnerability, you should update your Foxit PDF Reader and Editor applications to the latest versions. Updates can be obtained through the application's built-in update feature or by downloading the latest versions from the Foxit website. [1]

Executive Summary

This vulnerability occurs in Foxit PDF and Editor for Windows before versions 13.2 and 2025 before 2025.2. It involves a crafted PDF file containing JavaScript that calls the closeDoc() function while internal objects are still in use. This causes a use-after-free condition where these objects are prematurely released, potentially leading to memory corruption when the PDF is opened.

Impact Analysis

The vulnerability can lead to memory corruption, which may result in information disclosure when the crafted PDF is opened. This means that sensitive data could potentially be exposed due to exploitation of this flaw.

Compliance Impact

The vulnerability may lead to information disclosure when a crafted PDF is opened, which could potentially impact compliance with data protection standards such as GDPR or HIPAA by exposing sensitive information. However, specific effects on compliance or regulatory requirements are not detailed in the provided resources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-55308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart