Foxit PDF Editor EUVD-2026-42190

Exploitation requires a victim to actively open a specially crafted PDF file containing a malicious PRC 3D content section using an affected version of Foxit PDF Reader or Foxit PDF Editor. The CVSS vector (AV:L, UI:R) confirms the attack is file-based and requires active user interaction - the victim must open the file themselves; no network-facing service or background process is involved. No system privileges are required of the attacker (PR:N), meaning any user with the ability to open a file and deliver it to the target can trigger the vulnerability. Exploitation is constrained to hosts where an affected Foxit product version is installed. There is no evidence that default-disabled features or non-standard configurations are required - the PRC parsing path appears to be exercised whenever any PDF containing PRC 3D content is opened.

The CVSS 3.1 score of 6.1 (Medium) is grounded in a local file-based attack vector (AV:L) with mandatory user interaction (UI:R), meaningfully constraining real-world exposure compared to network-reachable vulnerabilities. The primary impact is a reliable application crash (A:H), with a secondary low-confidence memory disclosure (C:L) from the out-of-bounds read. EPSS data was not provided in the available intelligence, and the vulnerability does not appear in CISA KEV, so no confirmed active exploitation or in-the-wild activity can be asserted. No POC code has been identified. The attack surface is limited to desktop workstation sessions where users actively open attacker-supplied PDF files containing malicious PRC 3D content - there is no daemon, network service, or background processing path that could be exploited without user action. Overall prioritization: include in next routine patch cycle for organizations running Foxit products; not an emergency out-of-band response trigger absent KEV or POC signals.

An attacker crafts a PDF document containing a PRC 3D model header whose structure description metadata specifies array element counts that do not match the actual allocated buffer size. The file is delivered to a target user via email attachment, a malicious download link, or a shared file repository. When the victim opens the document in an affected version of Foxit PDF Reader or PDF Editor, the PRC header parser reads beyond the array boundary, triggering an application crash and potentially exposing small quantities of heap or stack memory to an attacker who can observe the crash output or memory dump.