Foxit PDF Reader EUVD-2026-42181

Exploitation requires the victim to open a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor with JavaScript execution enabled (the default), and the PDF must contain script that deletes a form field object and then re-accesses it. The concrete prerequisite is the reader's embedded JavaScript/AcroForm engine being active. Limiting factors: this is not remotely triggerable without user action (UI:R) - the attacker cannot reach the code path over a network service, only by delivering a file the user chooses to open; disabling JavaScript in the reader removes the condition entirely; and per the description the demonstrated outcome is an application crash, so any confidentiality/integrity impact depends on unproven exploitability of the use-after-free.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a client-side file-parsing bug: no privileges are required but user interaction is (the victim must open a malicious PDF), and the attack vector is local because exploitation depends on file delivery rather than a network service. There is notable tension in the data: the description only documents an application crash (a denial-of-service outcome, reinforced by the 'Denial Of Service' tag), yet the CVSS impact metrics assert High confidentiality and integrity impact - consistent with treating the use-after-free as potentially exploitable for code execution rather than mere DoS. This gap should be verified with the vendor advisory; if only a crash is achievable, real-world severity is lower than 7.8 implies. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified. Overall this is a routine but genuine client-side memory-safety bug: worth prioritizing patch deployment given the product's wide install base, but with no evidence of active exploitation.

An attacker emails or hosts a booby-trapped PDF whose embedded JavaScript deletes a form field object and then references it again; when the victim opens the document in a vulnerable Foxit PDF Reader or Editor, the dangling pointer is dereferenced and the application crashes, with potential for controlled memory reuse leading to code execution. Because the vector is local with required user interaction, exploitation hinges on social-engineering the target into opening the file. No public exploit code has been identified at time of analysis.