Memory Corruption in 3D Annotation Handling of Foxit PDF Reader
CVE-2025-66496

5.3MEDIUM

Key Information:

Vendor

Foxit Inc.

Status
Foxit
Foxit PDF Editor
Vendor
CVE Published:
19 December 2025

What is CVE-2025-66496?

A memory corruption vulnerability exists in the handling of 3D annotations within Foxit PDF Reader. This vulnerability stems from inadequate bounds checking during the parsing of PRC data. When users open a specially crafted PDF file containing malformed PRC content, it may lead to an out-of-bounds memory access, resulting in unpredictable behavior. Users are advised to ensure they are running the latest version of Foxit PDF Reader to mitigate this risk and protect their systems.

Affected Version(s)

Foxit PDF Editor Windows Versions 2025.2.1 and earlier

Foxit PDF Editor Windows Versions 14.0.1 and earlier

Foxit PDF Editor Windows Versions 13.2.1 and eariler

References

https://www.foxit.com/support/security-bulletins.html

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mat Powell of Trend of Trend Micro Zero Day Initiative
JSON
.
CVE-2025-66496 : Memory Corruption in 3D Annotation Handling of Foxit PDF Reader