This vulnerability (CVE-2025-66498) in Foxit PDF Reader involves an out-of-bounds read (CWE-125) caused by inadequate bounds checking during the parsing of U3D data within 3D annotations. When a PDF file contains malformed or specially crafted PRC content, the application may access memory outside the intended buffer, leading to memory corruption. The CVSS 3.1 base score is 5.3 (medium), reflecting local attack vector, low complexity, no privileges required, but user interaction is necessary. Affected versions include 2025.2.1 and earlier, 14.0.1 and earlier, and 13.2.1 and earlier. No patch or vendor advisory detailing remediation is currently provided.

Successful exploitation can cause memory corruption, potentially leading to application crashes or other unintended behavior. The confidentiality, integrity, and availability impacts are rated low. Exploitation requires local access and user interaction, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening PDF files from untrusted sources, especially those containing 3D annotations or PRC content. Monitor Foxit Software Inc. communications for updates or patches addressing this vulnerability.