Foxit PDF Editor and Reader EUVD-2026-25823

The vulnerability requires a user to explicitly open a crafted PDF file in Foxit PDF Editor or Foxit PDF Reader on a local system. No network access, authentication, or elevated privileges are needed, but user interaction is mandatory. The vulnerability is triggered only by PDFs with insufficient parameter values that fail validation checks during parsing; benign or properly-formatted PDFs do not trigger the exception. The scope is limited to the local user's Foxit process; no cross-user or cross-application impact occurs. Exploitation is not automatic - it depends entirely on the user choosing to open a specific malicious file.

CVSS 5.5 (Medium) reflects local attack vector, low complexity, no privileges required, but user interaction is mandatory - a user must open a crafted PDF file. The EPSS data is not provided, limiting probabilistic assessment. The vulnerability produces availability impact only (A:H) with no confidentiality or integrity consequences. CVSS indicates this is a reliable denial-of-service but not a data breach or code execution risk. However, the combination of AV:L (local) and UI:R (user interaction required) significantly constrains real-world exploitability compared to network-based flaws. The impact is localized to a single user's session; no scope expansion (S:U) means no privilege escalation or cross-process effects. Without KEV status or confirmed POC, this appears to be a standard application crash vulnerability rather than a security priority, though denial of service can disrupt workflows in critical environments. The lack of detailed vendor advisory (reference points only to general security bulletins page) adds uncertainty about affected versions and patch availability.

An attacker crafts a malicious PDF file with intentionally malformed parameters that bypass validation checks. The attacker distributes this file via email, file-sharing service, or compromised website. When a user downloads and opens the file in Foxit PDF Editor or Foxit PDF Reader, the parsing engine encounters the format error, raises an uncaught std::invalid_argument exception, and the application immediately terminates, causing the user to lose any unsaved work.