Foxit Pdf Editor EUVD-2026-17757

This is a moderate-priority denial-of-service vulnerability with notable real-world impact. CVSS 6.2 with local attack vector (AV:L) and low complexity (AC:L) correctly reflects the practical threat: any local user can craft and distribute a malicious PDF that crashes the application on any system where it is opened. The EPSS and KEV status are not provided, but the absence of network exploitability (AV:L) limits widespread automated abuse compared to remote vulnerabilities. However, in enterprise environments where PDFs are processed batch-wise (e.g., document management systems, automated report generation), this becomes a reliable denial-of-service primitive. The unauthenticated, no-interaction requirement (PR:N, UI:N) and availability impact (A:H) indicate legitimate priority. No public exploit or active KEV status was confirmed in provided data, but the straightforward nature of crafting cyclic PDF references suggests proof-of-concept code could be readily developed.

An attacker creates a PDF document with pages and annotations that reference each other in a loop (e.g., Page A → Annotation B → Page A). When a user or automated system opens this PDF in Foxit PDF Reader or Editor, the application attempts to parse and traverse the object tree. APIs within the application that perform deep recursion without cycle detection (such as SOAP handlers for document interchange) recursively follow the circular references, rapidly exhausting stack memory. Within seconds, the application crashes with a stack overflow error, causing denial of service. In an enterprise setting, an attacker could distribute such a PDF via email or document repository, causing widespread application crashes across the organization when users or automated systems attempt to process it.