Foxit PDF Editor and Reader, when processing JavaScript within PDF files, failed to enforce the required attribute authorization checks. This flaw allows a malicious PDF that the user trusts to read sensitive information from other documents opened in the same process and then send that data outside the host system. The weakness is rooted in CWE‑668, representing improper authorization controls.

The vulnerability affects Foxit Software Inc.'s PDF Reader and PDF Editor applications. No specific version ranges are provided; any release prior to the vendor’s published correction is potentially impacted.

The CVSS score for this issue is 4.7, indicating moderate severity. The EPSS score is reported as below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is an attacker delivering a malicious PDF to a user who opens it within the affected application; the malware logic would then read and export unintended content from other documents in the same process.