CVE-2025-55312

HighCVSS 7.8/10Last modified Oct 14, 2026

Description

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereference of invalid or released memory. This can lead to memory corruption, application crashes, and potentially allow an attacker to execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2025
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-553137.8An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary codCVE-2025-553147.8An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted viCVE-2025-553159.9Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a sCVE-2025-553167.8External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.CVE-2025-553177.8Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privilCVE-2025-553199.8Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2025-55326.4The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site ScripCVE-2025-553206.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorizedCVE-2025-553219.3Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perCVE-2025-553227.3Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.CVE-2025-553255.5Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-553267.5Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.
CVE-2025-55312: High severity, CVSS 7.8 | Vulnix