Introduction
A remote attacker can run code on a user's system just by getting the target to open a malicious PDF. That is the real-world risk from CVE-2025-9329, a high-severity vulnerability in the PRC file parsing logic of Foxit PDF Reader. Foxit PDF Reader is one of the most widely used alternatives to Adobe Acrobat, with hundreds of millions of users worldwide and a large presence in enterprise, government, and technical sectors. PRC, the format used to embed 3D models in PDFs, is a specialized but powerful feature, and it widens the attack surface for document-based exploits.
Technical information
CVE-2025-9329 is an out-of-bounds read vulnerability (CWE-125) in the PRC file parsing component of Foxit PDF Reader. The PRC (Product Representation Compact) format lets a PDF document carry embedded 3D data. When Foxit PDF Reader opens a PDF that contains a PRC stream, it calls a parser to interpret the 3D model data.
The bug triggers when that parser processes user-supplied PRC data with manipulated length or index fields. Because the parser does not validate these fields well enough, it may read past the end of the buffer allocated for the PRC structure. This out-of-bounds read can disclose information or, under certain conditions, enable remote code execution in the context of the current user.
Exploitation requires user interaction. The victim must open a malicious PDF or visit a web page that loads one. Mat Powell reported the flaw as ZDI-CAN-26772 through Trend Micro's Zero Day Initiative. No public proof-of-concept or code snippet is available at this time.
Patch information
Foxit has released updates for a related redaction issue in its PDF Editor, which could leave content only partially redacted under specific conditions. The issue occurs when the "Search and Redact" or "Smart Redact" feature is used with a multi-word search term containing spaces, and when the text object includes a character larger than the search text. Foxit fixed it in these versions:
- PDF Editor v2024.2.3
- PDF Editor v13.1.3
- Mac Editor v2024.2.3
Users should update to these versions so that redaction of sensitive information is complete and accurate. The updates are available for download on Foxit's official website. (foxit.com)
Affected systems and versions
CVE-2025-9329 affects Foxit PDF Reader installations that parse PRC streams in PDF documents. The vulnerability is present in all versions before the patched releases:
- Foxit PDF Reader for Windows: All versions before 2025.2.0.33046
- Foxit PDF Reader for Mac: All versions before 2025.2
- Foxit PDF Editor: All versions before v2024.2.3, v13.1.3, and Mac Editor v2024.2.3
Any configuration running these versions is vulnerable if it allows PRC content in PDFs to be parsed.
Vendor security history
Foxit Software has a history of memory safety issues in its PDF products. Earlier vulnerabilities include memory corruption in JavaScript execution and file parsing components, such as CVE-2020-14425 and CVE-2024-28888. Foxit generally answers vulnerability disclosures with coordinated patch releases, but the repeated memory corruption flaws indicate that writing secure parsers remains a persistent problem for the company. Foxit runs a dedicated security advisory portal and works with external researchers through programs like the Zero Day Initiative.
