Spoofing attack in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2025-59803
Published: September 26, 2025
Vulnerability identifier: #VU116124
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]
CVE-ID: CVE-2025-59803
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of documents that are embedded with specific triggers in the signing phase. A remote attacker can deceive users into signing the manipulated documents.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
How to mitigate CVE-2025-59803
Install updates from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.1.23955, 14.0.1.33197, 2025.2.1.33197
Foxit PDF Reader for Windows - update to 2025.2.1.33197
Foxit PDF Reader for Windows - update to 2025.2.1.33197