Introduction
Attackers can achieve arbitrary code execution on user systems if Foxit PDF Reader 2025.1.0.27937 processes a malicious PDF containing crafted JavaScript. The vulnerability, tracked as CVE-2025-32451, affects one of the most widely deployed PDF readers in enterprise and consumer environments.
About Foxit Software: Foxit Software is a major vendor in the global PDF technology market, with over 700 million users and products for creating, editing, and viewing PDFs. Foxit Reader is a popular alternative to Adobe Acrobat Reader, especially in business and government. Foxit's products are built into workflows worldwide, so a vulnerability in Foxit Reader has a wide impact across industries.
Technical Information
CVE-2025-32451 is a memory corruption vulnerability in Foxit PDF Reader 2025.1.0.27937. It comes from an uninitialized pointer that the JavaScript processing engine uses while handling JavaScript embedded in a PDF. A PDF with a malicious JavaScript payload triggers the bug. If certain fields in a signature object are missing during PDF signature verification, the application uses the pointer without properly initializing it first, which causes irregular memory access and memory corruption.
The vulnerability is classified as CWE-824 (Access of Uninitialized Pointer). Attackers can exploit it by crafting a PDF with embedded JavaScript designed to trigger the uninitialized pointer access. A successful exploit can corrupt memory and run arbitrary code with the privileges of the user running Foxit Reader. There are two ways to deliver the attack: convince a user to open the malicious PDF, or, if the Foxit browser plugin extension is enabled, lure them to a website that serves it.
The referenced advisories include no public code snippets or exploit samples.
Affected Systems and Versions
- Foxit PDF Reader 2025.1.0.27937 is confirmed vulnerable.
- The vulnerability affects both the desktop application and configurations with the browser plugin extension.
- Exploitation requires either opening a malicious PDF or visiting a site that serves one with the plugin enabled.
Vendor Security History
Foxit Software has a documented history of memory corruption and JavaScript engine vulnerabilities in its PDF products. Examples include:
- CVE-2020-14425: JavaScript-based RCE in Foxit Reader
- CVE-2024-28888: Use-after-free vulnerability enabling code execution
- Research in 2022 found that Foxit used an outdated V8 JavaScript engine, which exposed users to known vulnerabilities
Foxit usually releases patches promptly and publishes detailed security bulletins. The same vulnerability classes keep recurring, though, which points to ongoing problems with secure development and dependency management.
