Foxit PDF Editor/Reader has a use‑after‑free flaw triggered by a specially crafted PDF. When the document activates embedded scripts that alter annotation rich‑text attributes with malformed font data, the editor later rebuilds annotation appearance and accesses a memory object that has already been freed. This leads to an application crash and, as a side effect, exposes internal data that may contain sensitive information from the PDF or the host system. The vulnerability is classified as CWE‑416.

Foxit Software Inc. products, namely Foxit PDF Editor and Foxit PDF Reader, are affected. Specific version ranges are not disclosed in the advisory.

The CVSS base score is 7.8, indicating a high impact. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild at the time of assessment. The vulnerability is not in the KEV catalog. Attack requires an end‑user to open a malicious PDF, typically via local or network delivery, and rely on the victim running the corrupted file with JavaScript enabled.