This vulnerability arises when a PDF contains an abnormal annotation that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the program to crash. The failure to validate the annotation type maps to CWE‑843. The resulting crash leads to a denial‑of‑service condition where the victim’s PDF viewer becomes unavailable.

The issue affects Foxit PDF Editor and Foxit PDF Reader. No specific version range is mentioned, so all released versions may potentially be affected until a patch is applied.

The CVSS score of 7.8 classifies the flaw as high‑severity. The EPSS score of <1% indicates a low likelihood of exploitation, and the lack of KEV listing suggests no widespread exploitation yet. Attackers could still deliver malicious PDFs via email or the web, exploiting local user interaction to trigger the crash, but the precise delivery method is not explicitly described in the CVE text. The description implies that a malicious PDF opened by a user is likely the attack vector, as the vulnerability triggers during PDF parsing. Because the effect is only a crash, there is no direct code execution, but the high severity coupled with the ease of delivery makes it a significant risk for environments that rely on Foxit for document handling.