Remote Code Execution Vulnerability in Foxit PDF Reader
CVE-2025-9328

7.8HIGH

Key Information:

Vendor

Foxit
Status
PDF Reader
Vendor
CVE Published:
2 September 2025

What is CVE-2025-9328?

A vulnerability in Foxit PDF Reader's handling of PRC file parsing allows attackers to execute arbitrary code by exploiting improperly validated user-supplied data. This flaw can lead to a read beyond an allocated buffer, which can be triggered when a user interacts with a malicious web page or file. It highlights the importance of ensuring robust data validation mechanisms in software applications.

Affected Version(s)

PDF Reader 2024.4.0.27683

References

https://www.zerodayinitiative.com/advisories/ZDI-25-864/
x_research-advisory
https://www.foxit.com/support/security-bulletins.html
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-9328 : Remote Code Execution Vulnerability in Foxit PDF Reader