CVE-2025-59802 Security feature bypass in n/a
Attackers can modify visible content in signed PDFs without invalidating the digital signature by exploiting Optional Content Group visibility flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59802?
CVE-2025-59802 is a high-severity vulnerability in Foxit Pdf Editor, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a signed PDF to be modified without invalidating the signature. This may result in a mismatch between the signed content and what the signer or verifier sees, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
Weakness: CWE-290
Which versions are affected by CVE-2025-59802?
It affects 2 products.
Products include Foxit Pdf Editor, Foxit Pdf Reader.
How do I fix CVE-2025-59802?
No fix has been published for CVE-2025-59802 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59802 being exploited?
There is no known exploitation of CVE-2025-59802 in the wild and no public exploit code.
Other vulnerabilities in Foxit Pdf Editor
Sources
Also known as GHSA-rr6v-3f8x-4hwg.