Memory Corruption Flaw in Foxit PDF Reader Product by Foxit
CVE-2025-66497

5.3MEDIUM

Key Information:

Vendor

Foxit Inc.

Status
Foxit
Foxit PDF Editor
Vendor
CVE Published:
19 December 2025

What is CVE-2025-66497?

A memory corruption flaw has been identified in the 3D annotation handling of Foxit PDF Reader. This vulnerability arises from inadequate bounds checking during the parsing of PRC (Product Representation Compact) data. Attackers can exploit this flaw by crafting specially malformed PDF files that, when opened, lead to out-of-bounds memory access, thereby corrupting the application's memory. Users of affected versions are advised to apply security updates to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Foxit PDF Editor Windows Versions 2025.2.1 and earlier

Foxit PDF Editor Windows Versions 14.0.1 and earlier

Foxit PDF Editor Windows Versions 13.2.1 and eariler

References

https://www.foxit.com/support/security-bulletins.html

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mat Powell of Trend of Trend Micro Zero Day Initiative
JSON
.
CVE-2025-66497 : Memory Corruption Flaw in Foxit PDF Reader Product by Foxit