Foxit PDF Editor and Foxit PDF Reader process JavaScript embedded in PDF files. When a malicious PDF is opened, the embedded script manipulates page and document objects, causing internal page objects to become unsynchronized with the renderer. The renderer continues to trust an outdated page count, so subsequent access can read memory beyond bounds and ultimately crash the application. This flaw is classified as CWE‑125, an out‑of‑bounds read that results in a denial of service.

Foxit Software Inc.’s Foxit PDF Editor and Foxit PDF Reader are affected. The advisory does not list specific product releases, so any installation of these applications that has not applied the page‑synchronization fix remains vulnerable.

The CVSS score of 6.1 indicates moderate severity. With an EPSS score of less than 1 % and no listing in CISA’s KEV catalog, exploitation is expected to be infrequent. The flaw requires an attacker to open a malicious PDF on the target machine. Once the file is opened, the embedded JavaScript triggers the out‑of‑bounds read, causing the program to crash and disrupting the victim’s workflow. The attack vector is inferred to be local file access combined with user interaction, as the description indicates that a malicious PDF must be opened by a user for the JavaScript to execute.