The vulnerability exists in the interface of Foxit PDF Editor and Reader where the secure reading mode does not enforce permission checks when processing the importIcon feature. An attacker can craft a PDF that causes the application to perform SMB authentication against the user’s machine without prompting for credentials, resulting in the NTLM hash of the user’s account being exposed. This vulnerability is a classic example of improper authorization (CWE‑693) and leads to credential compromise.

Affected vendors include Foxit Software Inc., with products Foxit PDF Editor and Foxit PDF Reader. No specific version range is provided, so all deployed installations of these products are potentially vulnerable until patched.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% shows a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack scenario requires the victim to open a malicious PDF, which is a relatively common vector; the lack of a user prompt makes the exploitation more stealthy. However, because exposure occurs only through a local PDF file, remote exploitation is not possible without the target's interaction.