Improper control flow management allows a crafted document action chain to trigger modal dialog reentry on the main thread, causing the UI to freeze. The result is a local denial of service that renders the application unusable until it is closed and relaunched. The vulnerability does not provide credential escalation or data disclosure, but it can interrupt user workflow and impact availability.

Foxit Software Inc. products, specifically Foxit PDF Editor and Foxit PDF Reader. No specific version numbers are disclosed in the available data, so all installations of these products remain potentially vulnerable until an official update is applied.

The CVSS score of 5.5 characterizes this flaw as moderate. EPSS indicates an exploitation probability of less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring the attacker to supply a crafted PDF that a user opens on the affected system. Because the flaw is limited to a UI freeze, it does not lead to arbitrary code execution, but it can disrupt business operations if the application is critical to daily tasks.