CVE-2025-59802
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG.
Published Dec 11, 2025 · updated Oct 14, 2026 · foxit pdf editor
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a signed PDF to be modified without invalidating the signature. This may result in a mismatch between the signed content and what the signer or verifier sees, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
Timeline
Detection, updates, and resolution for this record.
Dec 11, 2025 · NIST NVD
Detected
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a s
Oct 14, 2026 · NIST NVD
Updated
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a s
Affected
- cpe foxit/pdf editorversion unspecified
- cpe foxit/pdf editor14.0.0.68868
- cpe foxit/pdf editor2025.1.0.66692
- cpe foxit/pdf editor2025.2.0.68868
- cpe foxit/pdf readerversion unspecified
Sources
- CVE.orgCVE-2025-59802
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-59802
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2025-59802
Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF tr
nvd.nist.gov