The flaw is a use‑after‑free bug triggered when a PDF containing JavaScript that deletes pages and removes attachment annotations is opened. During this process the attachment panel continues to access memory that has already been freed, causing the application to crash. The crash results in an interruption of user workflow and constitutes a loss of availability, but the public advisory does not indicate that arbitrary code can be executed or that the flaw leads to a full remote code execution scenario.

Foxit PDF Editor and Foxit PDF Reader released by Foxit Software Inc. are affected. The vulnerability exists in all builds not yet patched; no specific version identifiers are provided in the advisory.

The CVSS base score of 7.8 reflects a moderate to high severity vulnerability that can lead to an application crash. The EPSS score of < 1% indicates a low likelihood that this flaw will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation activity is documented. Attackers would need to supply a malicious PDF, typically via email or a web download; the flaw is therefore a local‑environment or user‑initiated attack vector. The crash can be considered a denial‑of‑service condition for the affected application.