CVE-2025-66495: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows and MacOS. When opening a PDF containing specially crafted JavaScript, a pointer to memory that has already been freed may be accessed or dereferenced, potentially allowing a remote attacker to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66495?
CVE-2025-66495 is considered a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2025-66495?
To fix CVE-2025-66495, users should update Foxit PDF Reader to version 2025.2.1 or later.
What versions of Foxit PDF Reader are affected by CVE-2025-66495?
CVE-2025-66495 affects Foxit PDF Reader versions prior to 2025.2.1, 14.0.1, and 13.2.1.
What types of systems are impacted by CVE-2025-66495?
CVE-2025-66495 impacts both Windows and MacOS systems running affected versions of Foxit PDF Reader.
What is the nature of the vulnerability in CVE-2025-66495?
CVE-2025-66495 is a use-after-free vulnerability that occurs when handling annotations in PDFs with malicious JavaScript.