CVE-2020-14425: Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API.

Security readout for executives and security teams

Foxit Reader before 10.0 had a flaw that could let a malicious document trigger local program execution while bypassing a security dialog. This is business-relevant because PDF readers are common user-facing software and the issue has public exploit references, though the bundle does not show active exploitation. Exposure is likely limited to workstations running Foxit Reader versions earlier than 10.0. Risk is higher where users open PDFs from email, web downloads, customer uploads, or other untrusted sources. The source bundle does not identify server products or other Foxit applications as affected. Treat this as high priority for endpoint patching, especially in environments with frequent external PDFs. It does not require assuming a current breach from the provided evidence, but public exploit references and command-execution impact justify accelerated remediation and clear exception tracking. Mitigation focus: Upgrade Foxit Reader to version 10.0 or later where present.; Check Foxit security bulletins for vendor-supported remediation guidance.; Prioritize systems handling external or high-risk PDF attachments..

Prepared

Jun 5, 2026, 13:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.