Technical impact
Foxit PDF Editor/Reader may process a specially crafted PDF that triggers JavaScript during page‑visibility events. This can cause the application to enter a re‑entrant path while a page‑view object has already been freed, resulting in an invalid memory read and a crash. The CVE description does not provide evidence of arbitrary code execution, so the impact is limited to denial of service.
Affected Systems
Foxit Software Inc. products: Foxit PDF Editor and Foxit PDF Reader. No specific vulnerable versions are listed, so any build prior to the latest vendor release may be affected.
Risk and Exploitability
The CVSS score of 7.8 marks the vulnerability as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation currently. The issue is not present in CISA’s KEV catalog. Exploitation would require the victim to open a malicious PDF, typically via email or a web download, which is a user‑initiated but remotely deliverable vector. This estimation is inferred from the description, as the threat requires user interaction.
