Foxit PDF Editor EUVD-2026-42191

Exploitation requires the victim to actively open a specially crafted PDF file containing embedded PRC (Product Representation Compact) 3D content using Foxit PDF Editor or Foxit PDF Reader - reflected in CVSS UI:R (user interaction required) and AV:L (local file access). No authentication or elevated privileges are required from the attacker's side (PR:N). The vulnerability triggers during the PRC entity parsing stage, meaning PDFs without embedded 3D PRC structures are not attack vectors; standard flat PDFs would not trigger this code path. Exploitation is limited to Windows or other platforms where Foxit products are installed; it does not affect other PDF readers. Three distinct version branches (2026.x, 14.x, 13.x) are vulnerable, meaning patching must be applied across all installed Foxit product versions in an environment.

The CVSS 3.1 score of 6.1 (Medium) reflects a local, user-interaction-required attack with high availability but low confidentiality impact and no integrity impact. The local attack vector (AV:L) indicates the PDF file must be opened on the victim's machine rather than exploited over the network, which materially reduces automated mass-exploitation potential. EPSS data is not provided in the input, so exploitation probability cannot be quantified here. KEV status is not listed, meaning CISA has not confirmed active exploitation - this should not be inferred as safe, only as not yet observed at scale. No POC is referenced in the provided data. The primary real-world risk is a denial-of-service (crash) against users who routinely open third-party or email-attached PDFs containing 3D content, plus a limited memory-disclosure vector. The multi-branch version span (three concurrent release lines all affected) suggests the flaw is present in a shared parsing library component across Foxit's product family, broadening the affected install base.

An attacker crafts a malicious PDF embedding a PRC 3D structure with a deliberately out-of-range entity index, then delivers it to a target via email attachment or a download link. When the victim opens the file in Foxit PDF Editor or PDF Reader and the 3D content is rendered, the vulnerable PRC parser accesses memory beyond the entity array boundary, immediately crashing the application. In a more targeted variant, the attacker inspects the leaked adjacent memory content for sensitive data exposed by the low-confidentiality impact, though this secondary goal requires additional capability to capture memory dumps from the crash.