When a PDF file containing JavaScript deletes form fields, the Foxit PDF Editor and Reader still use the old pointers to those fields. This leads to a use‑after‑free condition that can trigger a crash. The flaw is categorized as CWE‑416 and, while the description states a crash, the remote code execution claim is inferred from the title, indicating that an attacker might be able to exploit the invalid pointer to execute arbitrary code.

Foxit Software Inc.'s Foxit PDF Editor and Foxit PDF Reader are affected. No specific version information is provided, so any potentially vulnerable build of these products should be evaluated.

The CVSS score of 7.8 places the flaw in the high severity range, and the EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the user opening a malicious PDF file, either locally or over a network. Exploitation would require JavaScript execution within the PDF and deallocation of form fields, conditions that an attacker can engineer with a crafted document.