CVE-2025-59803 Business logic in n/a

What is CVE-2025-59803?

CVE-2025-59803 is a medium-severity vulnerability in Foxit Pdf Editor, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the triggers modify content on other pages or optional content layers without explicit warning. This can cause the signed PDF to differ from what the signer saw, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.

Weakness: CWE-347

Which versions are affected by CVE-2025-59803?

It affects 2 products.

Products include Foxit Pdf Editor, Foxit Pdf Reader.

How do I fix CVE-2025-59803?

No fix has been published for CVE-2025-59803 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-59803 being exploited?

There is no known exploitation of CVE-2025-59803 in the wild and no public exploit code.

Other vulnerabilities in Foxit Pdf Editor

• CVE-2022-28104 File upload in n/a Critical 9.8
• CVE-2022-24954 Memory corruption in n/a Critical 9.8
• CVE-2022-24955 Other in n/a Critical 9.8
• CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation High 8.8
• CVE-2026-91800 Foxit PDF Editor installer local privilege escalation High 8.8

All Foxit Pdf Editor vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4xr6-9wfx-7qvw.