This vulnerability (CVE-2025-66496) involves an out-of-bounds read (CWE-125) in Foxit PDF Reader's 3D annotation handling component. Specifically, the issue occurs due to inadequate bounds checking during the parsing of PRC data embedded in PDF files. When a user opens a PDF containing malformed or maliciously crafted PRC content, the application may access memory beyond allocated bounds, leading to memory corruption. The affected product versions include Foxit PDF Reader 2025.2.1 and earlier, 14.0.1 and earlier, and 13.2.1 and earlier. The CVSS 3.1 base score is 5.3, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability rated low.

Successful exploitation could result in memory corruption, which may lead to application crashes or potentially allow an attacker to execute arbitrary code or cause denial of service. However, the CVSS impact metrics indicate low impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild to date.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution when opening PDF files from untrusted sources, especially those containing 3D annotations or PRC data.