CVE Feed

    Dashboard / CVE / CVE-2013-10068

    CVE-2013-10068

    Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer, allowing remote attackers to execute arbitrary code.

    Published:Aug 5, 2025
    Last Modified:May 25, 2026
    EPS:Aug 5, 2025
    EPSS Score:0.58646
    CVSS Score:9.4

    Affected Products

    Vendor
    Foxit
    Product
    Reader
    Vendor
    Foxit Software
    Product
    Reader
    Vendor
    Foxitsoftware
    Product
    Foxit Reader

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-121 Stack-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-66499 (CVSS 7.8) — A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing speci…
    CVE-2025-66498 (CVSS 5.3) — A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient…
    CVE-2025-66496 (CVSS 5.3) — A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient…
    CVE-2025-66495 (CVSS 7.8) — A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, …
    CVE-2025-13941 (CVSS 8.8) — A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin…
    CVE-2025-32451 (CVSS 8.8) — A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized poi…
    CVE-2024-25938 (CVSS 8.8) — A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A speci…
    CVE-2023-38573 (CVSS 8.8) — A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specia…
    CVE-2021-27517 (CVSS 6.1) — Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High