Foxit PDF Editor and Reader lack sufficient verification of JPEG2000 image metadata inside PDFs, which results in an out‑of‑bounds heap write when decoding an attacker‑crafted file. This memory corruption can crash the application and, under certain conditions, allow an attacker to execute arbitrary code, providing full control over the affected system. The weakness aligns with CWE‑787 and is rated moderate to high severity.

The vulnerability applies to Foxit PDF Editor and Foxit PDF Reader distributed by Foxit Software Inc. No specific product versions are listed in the advisory, so all released builds prior to any patch may be affected.

The CVSS score of 7.8 indicates a high risk level, but the EPSS score is below 1 %, suggesting that exploitation is presently unlikely. The vulnerability is not present in the CISA KEV catalog. The attack vector is inferred to be remote because the flaw is triggered by opening a malicious PDF file, but the description does not explicitly state the required conditions. If an attacker gains the ability to provide a crafted PDF to a victim user, the out‑of‑bounds write could lead to arbitrary code execution.