CVE-2025-59803
Last modified
CVE-2025-59803 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the triggers modify content on other pages or optional content layers without explicit warning. This can cause the signed PDF to differ from what the signer saw, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Foxit | Pdf Editor | <= 13.2.0.63256 |
| Foxit | Pdf Editor | >= 2023.1.0.55583, <= 2023.3.0.63083 |
| Foxit | Pdf Editor | >= 2024.1.0.63682, <= 2024.4.1.66479 |
| Foxit | Pdf Editor | 14.0.0.68868 |
| Foxit | Pdf Editor | 2025.1.0.66692 |
| Foxit | Pdf Editor | 2025.2.0.68868 |
| Foxit | Pdf Reader | <= 2025.2.0.68868 |
| Foxit | Pdf Editor | <= 13.2.0.23874 |
| Foxit | Pdf Editor | >= 2023.1.0.15510, <= 2023.3.0.23028 |
| Foxit | Pdf Editor | >= 2024.1.0.23997, <= 2024.4.1.27687 |
| Foxit | Pdf Editor | 14.0.0.33046 |
| Foxit | Pdf Editor | 2025.1.0.27937 |
| Foxit | Pdf Editor | 2025.2.0.33046 |
| Foxit | Pdf Reader | <= 2025.2.0.33046 |
References
- https://www.foxit.com/support/security-bulletins.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59803?
How severe is CVE-2025-59803?
How do I fix CVE-2025-59803?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59798Artifex Ghostscript through 10.05.1 has a stack-based buffer…5.5
- CVE-2025-59799Artifex Ghostscript through 10.05.1 has a stack-based buffer…5.5
- CVE-2025-5980A vulnerability classified as critical was found in code-pro…9.8
- CVE-2025-59800In Artifex Ghostscript through 10.05.1, ocr_begin_page in de…5.5
- CVE-2025-59801In Artifex GhostXPS before 10.06.0, there is a stack-based b…4.3
- CVE-2025-59802Foxit PDF Editor and Reader before 2025.2.1 allow signature …7.5
- CVE-2025-59808An unverified password change vulnerability [CWE-620] vulner…6.8
- CVE-2025-59809A server-side request forgery (ssrf) vulnerability [CWE-918]…4.3
- CVE-2025-5981Arbitrary file write as the OSV-SCALIBR user on the host sys…6.5
- CVE-2025-59810An improper access control vulnerability in Fortinet FortiSO…6.5
- CVE-2025-59811Rejected reason: Not used
- CVE-2025-59812Rejected reason: Not used
Are you affected by CVE-2025-59803?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST