Foxit PDF Editor and Reader are affected by a heap‑based out‑of‑bounds read that occurs when the application parses malformed image soft‑mask data. Improper validation of the soft‑mask attribute can trigger an arithmetic underflow, allowing the program to read beyond the bounds of an allocated buffer. The resulting memory leak can reveal sensitive data from the application’s address space, while the crash can cause a denial of service.

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader. Version information is not specified in the advisory, so any unpatched release that processes image data may be impacted. Users should assume the risk applies to all current editions until a vendor‑issued update is available.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an adversary can craft a malicious PDF file containing corrupted soft‑mask information and entice a user to open it, which could enable memory disclosure or denial of service. The limited probability, combined with the absence from KEV, means the overall risk is moderate but mitigable through patching.