Log in Start free

Vulnerability · Published Dec 19, 2025 · Assigned by Foxit

CVE-2025-66493Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

High 7.8

In plain English

A high-severity use-after-free in Foxit PDF Editor from Foxit Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A use-after-free vulnerability exists in the AcroForm handling of Foxit PDF Reader and Foxit PDF Editor before 2025.2.1,14.0.1 and 13.2.1 on Windows . When opening a PDF containing specially crafted JavaScript, a pointer to memory that has already been freed may be accessed or dereferenced, potentially allowing a remote attacker to execute arbitrary code.

Affected products (as reported)

VendorProductVersions
Foxit Software Inc. Foxit PDF Editor Versions 2025.2.1 and earlierVersions 14.0.1 and earlierVersions 13.2.1 and earlier
Foxit Software Inc. Foxit PDF Reader Versions 2025.2.1 and earlierVersions 14.0.1 and earlierVersions 13.2.1 and earlier

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References