CVE-2025-66499 Foxit PDF Reader PDF Parsing Heap-Based Buffer Overflow Remote Code Execution Vulnerability
A remote attacker can execute arbitrary code by exploiting an integer overflow in Foxit PDF Reader's JBIG2 image parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-66499?
CVE-2025-66499 is a high-severity vulnerability in Foxit Pdf Editor, published on 19 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in the calculation of the image buffer size may occur, potentially allowing a remote attacker to execute arbitrary code.
Weakness: CWE-190
Which versions are affected by CVE-2025-66499?
It affects 2 products.
Products include Foxit Pdf Editor, Foxit Pdf Reader.
How do I fix CVE-2025-66499?
No fix has been published for CVE-2025-66499 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66499 being exploited?
There is no known exploitation of CVE-2025-66499 in the wild and no public exploit code.
Other vulnerabilities in Foxit Pdf Editor
Sources
Also known as GHSA-5w85-6378-9j4v.