Foxit PDF Editor and Reader EUVD-2026-25828

User interaction is required: the victim must deliberately open or load a malicious PDF document into Foxit PDF Editor or PDF Reader. Exploitation does not require authentication or special system privileges (PR:N). No specific Foxit configuration or feature enablement is documented as a prerequisite; the vulnerability affects default document processing in both products. Limitation: the attack is local (AV:L), so it cannot be triggered remotely without the attacker first delivering the malicious PDF to the target system via email, web download, file sharing, or removable media. The PDF must be opened in Foxit specifically; other PDF readers are not confirmed affected.

This vulnerability presents moderate real-world risk aligned with CVSS 5.5 scoring. Attack vector is local (AV:L) with low complexity (AC:L), unauthenticated access (PR:N), but requires user interaction (UI:R), significantly limiting attack surface compared to network-based threats. EPSS score data not provided, but the CVSS vector combination suggests exploitation is straightforward once a victim opens a malicious PDF. Denial-of-service impact (A:H, availability compromised) is real but non-critical in enterprise contexts unless targeting workstations performing critical PDF processing tasks. The use-after-free root cause (CWE-416) is a classic memory safety issue that could theoretically enable code execution if an attacker crafted the malicious PDF with sufficient precision to control heap layout, but the current CVE documentation reports only crashes, not RCE. No KEV listing or public POC identified, suggesting exploitation has not been observed in active attacks or security researcher publications. For organizations using Foxit products to process untrusted documents from external sources, this warrants prompt patching; for internal document workflows with trusted sources, risk is lower.

An attacker crafts a malicious PDF file containing carefully constructed page elements and structural metadata that trigger abnormal page lifecycle events when opened. A user opens the PDF in Foxit PDF Editor or Reader; the page lifecycle handler processes the malicious structure, causing internal object references to become invalid while the application retains stale pointers. When the user attempts a subsequent action-such as scrolling, printing, or navigating to another page-the application dereferences the invalid memory object, triggering a crash and denial of service.