This vulnerability (CVE-2025-66497) involves an out-of-bounds read (CWE-125) in Foxit PDF Reader's 3D annotation handling due to inadequate bounds checking of PRC data during parsing. When a PDF containing malformed or maliciously crafted PRC content is opened, the software may access memory outside the intended buffer, causing memory corruption. The affected versions include 2025.2.1 and earlier, 14.0.1 and earlier, and 13.2.1 and earlier. The CVSS 3.1 base score is 5.3, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation could result in memory corruption, potentially leading to application crashes or other unintended behavior. The impact on confidentiality, integrity, and availability is rated as low. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should exercise caution when opening PDF files from untrusted sources, especially those containing 3D annotations. Monitor Foxit Software Inc. advisories for updates or patches addressing this vulnerability.