Home
MEDIUM: 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDefault status
unaffected
Versions 2025.3 and earlier
affected
Versions 14.0.2 and earlier
affected
Versions 13.2.2 and earlier
affected
Default status
unaffected
Versions 2025.3 and earlier
affected
Description
The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.
Problem types
Product status
Versions 2025.3 and earlier
Versions 14.0.2 and earlier
Versions 13.2.2 and earlier
Versions 2025.3 and earlier
Credits
Suyue Guo from UCSB Seclab
References
www.foxit.com/support/security-bulletins.html