CVE-2025-55309: An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2

Medium severity · published Dec 11, 2025

CVE-2025-55309

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2

6.7

CVSS

0.1%

EPSS

On KEV

Description

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change handling prematurely releases the annotation object, resulting in a use-after-free vulnerability that may cause memory corruption or application crashes.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.1% · higher than 3% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Pdf Editor · Foxit

through 13.1.7.63027; 2023.1.0.55583 through 2023.3.0.63083; 2024.1.0.63682 through 2024.4.1.66479; 2025.1.0.66692; through 13.1.7.23637; 2023.1.0.15510 through 2023.3.0.23028; +2 more · source: NVD

Pdf Reader · Foxit

through 2025.1.0.66692; through 2025.1.0.27937 · source: NVD

Affected product

Pdf Editor

Foxit

All Pdf Editor CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-55309

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-55309

Vendor Advisory

https://www.foxit.com/support/security-bulletins.html