A signature validation flaw in Foxit PDF Editor/Reader permits attackers to modify visibly incremental changes to a signed PDF without invalidating the signature, enabling content spoofing while maintaining the appearance of a valid signature.

Foxit Software Inc. products, including Foxit PDF Editor and Foxit PDF Reader, are affected. No specific version information is disclosed, so any installations of these products are potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity and the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve distributing crafted incrementally updated PDFs to recipients; the signed document appears legitimate, permitting the attacker to alter content without detection. While exploitation risk is currently low, the impact if successful could mislead users relying on the signature for authenticity.