SB2025092611 - Two spoofing vulnerabilities in Foxit PDF Reader and Editor for Windows

Security Bulletin ID SB2025092611

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2025-59802)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect verification of cryptographic signature when handling certain signed documents that contain JavaScript. A remote attacker can manipulate document content and deceive users into trusting the manipulated documents.

2) Spoofing attack (CVE-ID: CVE-2025-59803)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of documents that are embedded with specific triggers in the signing phase. A remote attacker can deceive users into signing the manipulated documents.

Remediation

Install update from vendor's website.

References

https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2025.2.1+and+Foxit+PDF+Editor+2025.2.1%2F14.0.1%2F13.2.12025-09-25+00%3A00%3A00