Foxit PDF Editor and Reader contain a heap‑based out‑of‑bounds write caused by incorrect handling of bitmap stride and target buffer formats during WebP image decoding. The flaw is a classic buffer overflow (CWE‑787) that can corrupt memory and typically results in an application crash. The provided description does not indicate arbitrary code execution or data disclosure; the primary observable effect is a denial of service.

Foxit Software Inc. products – Foxit PDF Editor and Foxit PDF Reader – are affected. No specific version ranges are supplied in the CNA data, so any installation that incorporates the vulnerable WebP decoder can be compromised.

The CVSS score is 7.8 (high), but the EPSS rating is below 1 % and the vulnerability is not listed in the KEV catalog, indicating a very low likelihood of current exploitation. Attackers would need to supply a malicious PDF containing a WebP image that triggers the stride confusion. The scenario therefore appears to be a local or user‑initiated attack vector rather than a remote network‐based threat.