The vulnerability arises from inconsistencies between page element relationships and internal indexing in Foxit PDF Editor and Reader. When a PDF containing script-initiated modifications is opened, object references can become invalid while page metadata queries continue, leading to a use‑after‑free that can trigger a crash. According to the CVE title, an attacker may be able to coerce the application into executing arbitrary code, although the raw description only documents a crash.

Foxit Software Inc.'s products affected are Foxit PDF Editor and Foxit PDF Reader. No specific version information is listed, implying that all releases that support AcroForm annotation processing are susceptible. This includes both the free and paid editions distributed through the Foxit support portal.

The CVSS score of 7.8 reflects a high severity. The EPSS score of less than 1 percent suggests that exploitation is currently unlikely but not impossible. The vulnerability is not in CISA's KEV catalog, and no official patch is listed, so users should proceed with caution. The most likely attack vector is delivery through a malicious PDF document that a user opens locally or via email, which could trigger the use‑after‑free and potentially lead to malicious code execution if an attacker crafts a payload to exploit the crash.