Filtered by vendor Foxit
Subscribe
Total
390 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-55311 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 6.5 MEDIUM |
| An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript to alter annotation content and subsequently clear the file's modification status via JavaScript interfaces. This circumvents digital signature verification by hiding document modifications, allowing an attacker to mislead users about the document's integrity and compromise the trustworthiness of signed PDFs. | |||||
| CVE-2025-55307 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-14 | N/A | 3.3 LOW |
| An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption. | |||||
| CVE-2025-59802 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 7.5 HIGH |
| Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a signed PDF to be modified without invalidating the signature. This may result in a mismatch between the signed content and what the signer or verifier sees, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1. | |||||
| CVE-2025-55312 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 7.8 HIGH |
| An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereference of invalid or released memory. This can lead to memory corruption, application crashes, and potentially allow an attacker to execute arbitrary code. | |||||
| CVE-2025-55313 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 7.8 HIGH |
| An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when processing crafted PDF files. The vulnerability stems from insufficient handling of memory allocation failures after assigning an extremely large value to a form field's charLimit property via JavaScript. This can result in memory corruption and may allow an attacker to execute arbitrary code by persuading a user to open a malicious file. | |||||
| CVE-2025-59803 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 5.3 MEDIUM |
| Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the triggers modify content on other pages or optional content layers without explicit warning. This can cause the signed PDF to differ from what the signer saw, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1. | |||||
| CVE-2026-91803 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 8.8 HIGH |
| A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges. | |||||
| CVE-2026-91809 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash. | |||||
| CVE-2026-91810 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 6.1 MEDIUM |
| A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash. | |||||
| CVE-2026-91812 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.9 HIGH |
| A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges. | |||||
| CVE-2026-91813 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 8.8 HIGH |
| A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges. | |||||
| CVE-2026-91815 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution. | |||||
| CVE-2026-91816 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash. | |||||
| CVE-2026-91818 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash. | |||||
| CVE-2026-91804 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes. | |||||
| CVE-2026-91802 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash. | |||||
| CVE-2026-91801 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution. | |||||
| CVE-2026-91808 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 6.1 MEDIUM |
| A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash. | |||||
| CVE-2026-91799 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution. | |||||
| CVE-2026-91797 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened. | |||||