CVE-2025-59802
Last modified
CVE-2025-59802 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a signed PDF to be modified without invalidating the signature. This may result in a mismatch between the signed content and what the signer or verifier sees, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Foxit | Pdf Editor | <= 13.2.0.63256 |
| Foxit | Pdf Editor | >= 2023.1.0.55583, <= 2023.3.0.63083 |
| Foxit | Pdf Editor | >= 2024.1.0.63682, <= 2024.4.1.66479 |
| Foxit | Pdf Editor | 14.0.0.68868 |
| Foxit | Pdf Editor | 2025.1.0.66692 |
| Foxit | Pdf Editor | 2025.2.0.68868 |
| Foxit | Pdf Reader | <= 2025.2.0.68868 |
| Foxit | Pdf Editor | <= 13.2.0.23874 |
| Foxit | Pdf Editor | >= 2023.1.0.15510, <= 2023.3.0.23028 |
| Foxit | Pdf Editor | >= 2024.1.0.23997, <= 2024.4.1.27687 |
| Foxit | Pdf Editor | 14.0.0.33046 |
| Foxit | Pdf Editor | 2025.1.0.27937 |
| Foxit | Pdf Editor | 2025.2.0.33046 |
| Foxit | Pdf Reader | <= 2025.2.0.33046 |
References
- https://www.foxit.com/support/security-bulletins.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59802?
How severe is CVE-2025-59802?
How do I fix CVE-2025-59802?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59797Profession Fit 5.0.99 Build 44910 allows authorization bypas…5.8
- CVE-2025-59798Artifex Ghostscript through 10.05.1 has a stack-based buffer…5.5
- CVE-2025-59799Artifex Ghostscript through 10.05.1 has a stack-based buffer…5.5
- CVE-2025-5980A vulnerability classified as critical was found in code-pro…9.8
- CVE-2025-59800In Artifex Ghostscript through 10.05.1, ocr_begin_page in de…5.5
- CVE-2025-59801In Artifex GhostXPS before 10.06.0, there is a stack-based b…4.3
- CVE-2025-59803Foxit PDF Editor and Reader before 2025.2.1 allow signature …5.3
- CVE-2025-59808An unverified password change vulnerability [CWE-620] vulner…6.8
- CVE-2025-59809A server-side request forgery (ssrf) vulnerability [CWE-918]…4.3
- CVE-2025-5981Arbitrary file write as the OSV-SCALIBR user on the host sys…6.5
- CVE-2025-59810An improper access control vulnerability in Fortinet FortiSO…6.5
- CVE-2025-59811Rejected reason: Not used
Are you affected by CVE-2025-59802?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST