fkie_cve-2025-59803
Vulnerability from fkie_nvd
Published
2025-12-11 16:16
Modified
2025-12-15 20:17
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Summary
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the triggers modify content on other pages or optional content layers without explicit warning. This can cause the signed PDF to differ from what the signer saw, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
References
cve@mitre.orghttps://www.foxit.com/support/security-bulletins.htmlVendor Advisory
Impacted products
Vendor Product Version
foxit pdf_editor *
foxit pdf_editor *
foxit pdf_editor *
foxit pdf_editor 14.0.0.68868
foxit pdf_editor 2025.1.0.66692
foxit pdf_editor 2025.2.0.68868
foxit pdf_reader *
apple macos -
foxit pdf_editor *
foxit pdf_editor *
foxit pdf_editor *
foxit pdf_editor 14.0.0.33046
foxit pdf_editor 2025.1.0.27937
foxit pdf_editor 2025.2.0.33046
foxit pdf_reader *
microsoft windows -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "98F66B0B-2720-49C7-8FEF-42F039A47893",
              "versionEndIncluding": "13.2.0.63256",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8785CCE-C44C-4908-9133-13A580D5BECB",
              "versionEndIncluding": "2023.3.0.63083",
              "versionStartIncluding": "2023.1.0.55583",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF043D20-0E28-481C-8756-D1301FAE67D2",
              "versionEndIncluding": "2024.4.1.66479",
              "versionStartIncluding": "2024.1.0.63682",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:14.0.0.68868:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEC6BB18-E885-4970-A74F-AE84FF80C9B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:2025.1.0.66692:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0FF839F-37E7-4AFA-85B1-FC98366B14E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:2025.2.0.68868:*:*:*:*:*:*:*",
              "matchCriteriaId": "8869E158-A89B-4850-B7CD-A87A37EDFFB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5DC4E55-7875-4716-9520-0A7393516AF1",
              "versionEndIncluding": "2025.2.0.68868",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDAE2F8C-A99D-418B-84D8-AC1D9CC77411",
              "versionEndIncluding": "13.2.0.23874",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64",
              "versionEndIncluding": "2023.3.0.23028",
              "versionStartIncluding": "2023.1.0.15510",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C06BC41-9831-4AE3-B10B-3FC313D01580",
              "versionEndIncluding": "2024.4.1.27687",
              "versionStartIncluding": "2024.1.0.23997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:14.0.0.33046:*:*:*:*:*:*:*",
              "matchCriteriaId": "31590014-7822-4C3F-8A12-15E6D87CB689",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:2025.1.0.27937:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FDC914F-B999-4233-8BEA-CA20B1F0D9D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:2025.2.0.33046:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFFEC0E6-522C-4680-9A24-AD6FB023014C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB84418F-2B66-4F22-8300-A893A3D0FA83",
              "versionEndIncluding": "2025.2.0.33046",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the triggers modify content on other pages or optional content layers without explicit warning. This can cause the signed PDF to differ from what the signer saw, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1."
    }
  ],
  "id": "CVE-2025-59803",
  "lastModified": "2025-12-15T20:17:46.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-11T16:16:27.013",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.foxit.com/support/security-bulletins.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.