CVE-2025-9327: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2025-9327 is an out-of-bounds read information disclosure vulnerability in Foxit PDF Reader and PDF Editor, affecting the parsing of PRC files. It was reported to Foxit on March 25, 2025, and publicly disclosed on August 21, 2025, via the Zero Day Initiative advisory ZDI-25-865 (ZDI Advisory). Affected products include Foxit PDF Reader (all versions prior to 2025.1.0.27937) and Foxit PDF Editor (versions up to 13.1.7.23637, 2023.1.0.15510–2023.3.0.23028, 2024.1.0.23997–2024.4.1.27687, and 2025.1.0.27937) (ZDI Advisory, Foxit Security Bulletins). The CVSS v3.1 base score is 5.5 (Medium) per NVD, while ZDI rates it 3.3 (Low).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and stems from insufficient validation of user-supplied data during PRC file parsing within Foxit PDF Reader and PDF Editor (ZDI Advisory). When a user opens a specially crafted PRC file (a 3D model format embedded in PDFs), the application reads past the end of an allocated buffer, potentially exposing adjacent memory contents. Exploitation requires local access and user interaction — the target must open a malicious file or visit a malicious page — and the vulnerability can be chained with other flaws to achieve arbitrary code execution in the context of the current process (ZDI Advisory). The vulnerability was discovered and reported by Mat Powell of Trend Micro Zero Day Initiative.

The primary impact is information disclosure, where sensitive data from the application's memory may be exposed to an attacker (ZDI Advisory). While the vulnerability does not directly enable code execution on its own, it can be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Confidentiality is the sole impacted security property; integrity and availability are not directly affected.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction (opening a malicious file or visiting a malicious page), which further limits the attack surface. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Craft malicious PRC file: Create a specially crafted PRC (Product Representation Compact) 3D model file with malformed data designed to trigger an out-of-bounds read during parsing.
2. Deliver the payload: Embed the malicious PRC file within a PDF document and distribute it via phishing email, malicious website, or other social engineering vector to the target.
3. Induce user interaction: Trick the target into opening the malicious PDF file using Foxit PDF Reader or PDF Editor, or visiting a web page that triggers automatic rendering of the file.
4. Trigger out-of-bounds read: When Foxit parses the PRC content, the lack of proper input validation causes the application to read beyond the allocated buffer boundary, exposing adjacent memory.
5. Harvest disclosed information: Capture the leaked memory contents (e.g., via a side-channel or by chaining with another vulnerability) to obtain sensitive data such as pointers, credentials, or other in-memory artifacts.
6. Chain with additional exploit (optional): Use the disclosed memory information (e.g., ASLR bypass via leaked pointers) as a stepping stone to exploit a separate code execution vulnerability in the same process (ZDI Advisory).

• File System: Presence of unexpected or suspicious PDF files containing embedded PRC 3D model data received from unknown sources; temporary files created by Foxit in unusual directories during PDF rendering.
• Process: Foxit PDF Reader or PDF Editor processes exhibiting abnormal memory access patterns or crashing unexpectedly when opening specific PDF files, which may indicate triggered out-of-bounds reads.
• Logs: Application crash logs or Windows Event Logs referencing Foxit PDF Reader faulting module during PRC file parsing; Dr. Watson or Windows Error Reporting entries tied to FoxitPDFReader.exe or FoxitPDFEditor.exe.
• Network: Outbound connections from Foxit processes to unexpected external IP addresses or domains shortly after opening a PDF file, which may indicate chained exploitation (ZDI Advisory).

Foxit has released a patch addressing this vulnerability. Users should update Foxit PDF Reader and Foxit PDF Editor to version 2025.1.0.27937 or later (Foxit Security Bulletins). As interim mitigations, users should avoid opening PDF files from untrusted or unknown sources, and organizations should consider implementing application whitelisting and user awareness training around suspicious file handling. No configuration-based workaround has been published by the vendor.

The vulnerability was disclosed through Trend Micro's Zero Day Initiative program, with credit given to researcher Mat Powell (ZDI Advisory). No significant broader media coverage, vendor statements beyond the security bulletin, or notable community commentary has been identified for this CVE.