Technical impact
When rendering a page image, the Foxit PDF Editor/Reader does not validate image objects that have malformed optional content attributes, which enables a use‑after‑free condition. The flaw can cause the program to access memory that has already been freed, leading to a crash. This results in a denial‑of‑service vulnerability, as an attacker can cause the application to terminate when a crafted PDF is viewed. The weakness is a classic use‑after‑free flaw, formally identified as CWE‑416.
Affected Systems
The affected products are Foxit Software Inc.’s Foxit PDF Editor and Foxit PDF Reader. No specific version ranges are listed in the advisory, so all installs could be vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 7.8 classifies the vulnerability as high severity, yet the EPSS score of less than 1% indicates a very low estimated exploitation likelihood at present. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is local: a malicious PDF file that a user opens triggers the bug. Without an exploitable code‑execution path, the primary risk is disruptive service interruption rather than data compromise.
