The vulnerability is a heap-based out-of-bounds read in Foxit PDF Editor/Reader when processing malformed PDF image masks. Inconsistent image metadata leads to incorrect alpha‑channel processing during rendering, causing the application to read beyond the bounds of the allocated buffer. This can expose internal memory contents and results in an application crash. The weakness is identified as CWE‑125.

Foxit Software Inc. products Foxit PDF Editor and Foxit PDF Reader are affected. Any version that processes PDFs with malformed image masks may be vulnerable; users should verify the installed version and plan to update when a fix is available.

The CVSS score of 6.1 denotes moderate severity, while the EPSS score of less than 1 % indicates a very low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Because the code is executed during PDF rendering, an attacker may attempt to trick a user into opening a malicious file, causing a crash or potential exposure of memory contents, but the impact is limited to the local application without remote code execution. The attack vector is inferred to be local or through user interaction, as the vulnerable code is part of document rendering.