A crafted PDF that contains an XFA form can trigger a use‑after‑free condition during the calculate event handling in Foxit PDF Editor or Foxit PDF Reader. The flaw causes the application to crash and allows arbitrary code execution, enabling the attacker to run arbitrary programs with the privileges of the user launching the file. This vulnerability is a classic use‑after‑free error (CWE‑416).

The affected products are Foxit PDF Editor and Foxit PDF Reader produced by Foxit Software Inc. Specific version information was not disclosed; therefore all released versions of these applications are considered vulnerable until an official fix is released.

The CVSS v3.1 score of 5.5 indicates a moderate severity attack. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker must supply a malicious PDF to a user who opens or views the file. If the user opens a crafted PDF, the application will crash and can execute arbitrary code, potentially compromising the user’s system.