Introduction
Remote attackers can execute code on endpoints running Foxit PDF Reader simply by getting a user to open a malicious PDF with embedded 3D content. Foxit PDF Reader has over 700 million users and a dominant position in the PDF software market, with wide deployment across enterprises and government. A flaw in its file parsing routines carries significant downstream risk for any organization that relies on PDF workflows.
Foxit Software sells PDF software worldwide, including Foxit PDF Reader and Foxit PDF Editor. Its products have a reputation for performance and a broad feature set, and they are used widely in business and the public sector. Foxit has a history of memory-safety issues in its PDF processing code, including use-after-free and out-of-bounds read/write vulnerabilities. It usually responds quickly to coordinated disclosures, publishing advisories and patches.
Technical Information
CVE-2025-9326 is an out-of-bounds read in the component of Foxit PDF Reader that parses PRC (Product Representation Compact) files. PRC is a binary format for embedding 3D models in PDF documents. The parser does not properly validate user-controlled data. When it handles certain PRC structures, it does not check that reads stay within the allocated buffer, so a read can access memory beyond that buffer (CWE-125).
An attacker can craft a PDF containing specially formed PRC data. When a user opens the file in a vulnerable version of Foxit PDF Reader, the application may read memory outside the allocated buffer. Depending on the memory layout and the exploitation technique, that read can leak sensitive data or enable remote code execution in the context of the user. The attack requires user interaction, such as opening the malicious PDF or visiting a web page that triggers the vulnerable code path.
Trend Micro's Zero Day Initiative reported the vulnerability as ZDI-CAN-26784. At the time of writing, no public proof of concept or code snippets are available. The flaw is closely related to memory-safety issues previously disclosed in Foxit's PDF parsing routines, especially those involving 3D and annotation objects.
Patch Information
Foxit fixed several security vulnerabilities in its PDF Editor and Reader products through a series of updates released in 2024. The patches target risks in specific features and improve the software's stability and security.
Out-of-Bounds Read/Write Vulnerabilities
The updates fixed vulnerabilities that exposed the application to out-of-bounds reads and writes, which could lead to crashes or remote code execution. They were tied to parsing certain PDF files or handling specific Annotation objects, U3D files, Doc objects, or 3D objects in AcroForms.
The updates improve bounds checking and memory management. Users should update to the latest version of Foxit PDF Editor to remove these risks.
Recommendations
Keep your Foxit PDF applications on the latest versions for security and stability. There are two ways to update:
- In the application, click "Help" > "About Foxit PDF Editor" or "About Foxit PDF Reader" > "Check for Update".
- Download the updated version directly from Foxit's official website.
Foxit's official security bulletins have more detail on these updates and the specific vulnerabilities they fix: https://foxit.com/support/security-bulletins.html
Affected Systems and Versions
- Foxit PDF Reader versions prior to 2025.2.0.33028 are affected.
- Foxit PDF Editor versions prior to 2025.2.0.33046 are affected.
- The vulnerability is triggered when a user opens a malicious PDF containing specially crafted PRC (Product Representation Compact) data.
- Both Windows and Mac installations running these versions are affected.
Vendor Security History
Foxit Software has a documented history of memory-safety vulnerabilities in its PDF Reader and Editor products. Past issues include use-after-free, out-of-bounds read/write, type confusion, and DLL hijacking vulnerabilities. Foxit usually responds quickly to responsible disclosures, with coordinated patches and public security bulletins. Memory-safety flaws keep recurring, though, which points to persistent weaknesses in how Foxit writes and reviews complex file parsing logic.
