The flaw is a use‑after‑free bug triggered when a PDF containing JavaScript that deletes pages and removes attachment annotations is opened. During this process the attachment panel continues to access memory that has already been freed, causing the application to crash. The crash results in an interruption of user workflow and constitutes a loss of availability, and the CVE title indicates that this use‑after‑free could also allow arbitrary code execution, though the advisory text does not detail the exploit path.

Foxit PDF Editor and Foxit PDF Reader released by Foxit Software Inc. are affected. The vulnerability exists in all builds not yet patched; no specific version identifiers are provided in the advisory.

The CVSS base score of 7.8 reflects a moderate to high severity vulnerability that can lead to an application crash. The EPSS score of < 1% indicates a low likelihood that this flaw will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation activity is documented. Based on the description, it is inferred that the attack vector is user‑initiated, typically through a malicious PDF received via email or downloaded. The crash can be considered a denial‑of‑service condition for the affected application, and the CVE title indicates potential for remote code execution.