A heap-based out-of-bounds write vulnerability exists in the rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. The insufficient validation of the appearance geometry leads to memory corruption, which can result in application crashes or denial of service. This weakness is categorized as CWE-787, a classic out-of-bounds write flaw.

Foxit Software Inc. products, namely Foxit PDF Editor and Foxit PDF Reader, are impacted. No specific version information is provided, so all releases that include the vulnerable rendering logic are potentially affected.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply a maliciously crafted PDF to a target system. The likely attack vector is local–an adversary who can deliver a PDF to a user or a system component that opens PDF files. If exploited, the memory corruption could lead to crashes or potentially permit arbitrary code execution if additional flaws are present.