When a PDF file containing JavaScript deletes form fields, the Foxit PDF Editor and Reader still use the old pointers to those fields. This leads to a use‑after‑free condition that can trigger a crash. The flaw is categorized as CWE‑416. The disaster is a denial of service via application crash, with no evidence in the description of arbitrary code execution.

Foxit Software Inc.'s Foxit PDF Editor and Foxit PDF Reader are affected. No specific version information is provided, so any potentially vulnerable build of these products should be evaluated.

The CVSS score of 7.8 places the flaw in the high severity range, and the EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the user opening a malicious PDF file, either locally or over a network. Exploitation would require JavaScript execution within the PDF and deallocation of form fields, conditions that an attacker can engineer with a crafted document.