CVE-2025-59802
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| foxit | pdf_editor | to 13.2.0.63256 (inc) |
| foxit | pdf_editor | From 2023.1.0.55583 (inc) to 2023.3.0.63083 (inc) |
| foxit | pdf_editor | From 2024.1.0.63682 (inc) to 2024.4.1.66479 (inc) |
| foxit | pdf_editor | 14.0.0.68868 |
| foxit | pdf_editor | 2025.1.0.66692 |
| foxit | pdf_editor | 2025.2.0.68868 |
| foxit | pdf_reader | to 2025.2.0.68868 (inc) |
| apple | macos | * |
| foxit | pdf_editor | to 13.2.0.23874 (inc) |
| foxit | pdf_editor | From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc) |
| foxit | pdf_editor | From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc) |
| foxit | pdf_editor | 14.0.0.33046 |
| foxit | pdf_editor | 2025.1.0.27937 |
| foxit | pdf_editor | 2025.2.0.33046 |
| foxit | pdf_reader | to 2025.2.0.33046 (inc) |
| microsoft | windows | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Foxit PDF Editor and Reader before version 2025.2.1 allows an attacker to spoof digital signatures using Optional Content Groups (OCG). The state property of an OCG is runtime-only and not included in the digital signature computation, so an attacker can use JavaScript or PDF triggers to change the visibility of OCG content after the document is signed. This means the visual content of a signed PDF can be altered without invalidating the signature, causing a mismatch between the signed content and what the signer or verifier sees, undermining the trustworthiness of the digital signature.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to modify the visible content of a digitally signed PDF without breaking the signature's validity. This can lead to misinformation, fraud, or unauthorized changes appearing legitimate, potentially causing trust issues, legal problems, or financial loss if the signed documents are relied upon for critical decisions.
What immediate steps should I take to mitigate this vulnerability?
Update Foxit PDF Editor and Reader to version 2025.2.1 or later, or to versions 14.0.1 or 13.2.1, which contain the fix for this vulnerability.