Foxit PDF Reader EUVD-2026-42182

Exploitation requires the victim to open a malicious PDF in Foxit PDF Reader or Foxit PDF Editor, and that document must contain JavaScript together with a deliberately damaged/malformed form-field (AcroForm) tree that drives field traversal into a freed form object. The concrete prerequisites are: JavaScript actions must be enabled in the Foxit client (the default), the local user must interactively open the attacker-supplied file (CVSS UI:R), and the target must be a vulnerable version (Reader/Editor 2026.1.1, Editor 13.2.4 or 14.0.4 and earlier). Limiting factors: this is a local vector (AV:L) with no network-triggered path, it cannot fire without user interaction, and it is neutralized if JavaScript is disabled in Foxit - meaningfully reducing realistic risk versus the raw 7.8 score.

The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): local attack vector, low complexity, no privileges, but user interaction required - i.e., the victim must open a crafted file. There is a notable signal conflict: the description only demonstrates a crash from reading an invalid pointer (a denial-of-service outcome, reinforced by the vendor's 'Denial Of Service' tag), yet the vector claims full confidentiality and integrity impact (C:H/I:H) implying code execution - verify exploitability with the vendor before assuming RCE. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation or public exploit code - the realistic near-term risk is opportunistic (malicious PDF via email/download) rather than mass-automated. This is a legitimate patch priority for endpoints handling untrusted PDFs given the ubiquity of PDF as an attack delivery format, but the 'local + user-interaction-required' profile makes it lower urgency than a remote unauthenticated flaw.

An attacker emails or hosts a booby-trapped PDF containing JavaScript and a deliberately corrupted form-field tree; when the victim opens it in a vulnerable Foxit PDF Reader or Editor, the script triggers field traversal on a freed form object and the invalid pointer read crashes the application. Because the flaw is a use-after-free, a more sophisticated attacker could attempt heap grooming to replace the freed object and turn the crash into memory corruption. No public POC was provided, and successful exploitation depends on the victim opening the file (UI:R).