The flaw arises when an embedded JavaScript section of a PDF deletes internal pages, causing annotation objects to become invalid. The application then tries to write to these invalid annotations, which triggers a crash. The description mentions a use‑after‑free condition that could potentially allow remote code execution, but the official statement only reports a crash, so the primary impact is denial of service. This conclusion is inferred from the lack of any mention of code execution beyond the crash.

Foxit PDF Editor and Foxit PDF Reader are affected. The CNA did not list any specific versions, so all released releases of these products may contain the flaw, pending vendor verification.

The CVSS score of 7.8 labels the vulnerability as high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The most likely attack scenario involves a malicious PDF delivered via email, download, or any medium that can embed malicious JavaScript, since the vulnerability is triggered by the viewer’s handling of that PDF. No evidence in the description indicates that an attacker can gain arbitrary code execution; the outcome described is application crash.