Foxit PDF Reader EUVD-2026-42198

The target must actively open a specially crafted PDF file containing an abnormal color space definition that references a valid but semantically malformed function object, using an affected version of Foxit PDF Editor (13.2.4 and earlier, 14.0.4 and earlier, or 2026.1.1 and earlier) or Foxit PDF Reader (2026.1.1 and earlier). The CVSS UI:R metric confirms that passive or drive-by exploitation without explicit file-open action is not possible - the victim must open the document. The CVSS PR:N metric confirms no authentication or elevated privileges are required on the host system; any standard user account running a vulnerable Foxit installation is at risk. Exploitation is bounded to the color space processing subsystem - standard PDFs without abnormal color space function definitions are unaffected. The local attack vector (AV:L) reflects the file-based delivery model; the attacker does not interact directly with a network service but relies on the victim to open the file. The primary limiting factor for defenders is controlling which PDF files reach end users - gateway sandboxing directly addresses this condition.

The CVSS 3.1 score of 6.1 Medium with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H accurately reflects the file-based, user-interaction-dependent nature of this vulnerability. The primary impact is denial-of-service via application crash (A:H); the secondary C:L component suggests that out-of-bounds memory contents could potentially be observable, but exploiting this for meaningful data extraction would require additional tooling beyond a simple crash trigger. No EPSS data was provided in the available intelligence, limiting probabilistic exploitation modeling. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified - these two signals together suggest this has not been actively weaponized at scale. Despite AC:L and PR:N lowering the crafting barrier, the mandatory UI:R (victim must open the malicious file) constrains opportunistic exploitation. For organizations where Foxit PDF is deployed on endpoints that routinely handle untrusted document sources - legal, financial, or government environments - the realistic priority is moderate, elevated by the broad version scope (three distinct branch ceilings: 13.2.4, 14.0.4, and 2026.1.1).

An attacker constructs a PDF document that embeds a color space definition referencing a specially crafted function with semantically malformed output values and delivers it to a victim via a phishing email or a compromised file-sharing link. When the victim opens the file in an unpatched version of Foxit PDF Reader or Editor, the rendering engine processes the color space function without validating its output, generating an illegal pointer that triggers an out-of-bounds read and crashes the application. No public exploit code has been confirmed, but knowledge of the PDF specification and the vulnerable code path is sufficient to construct a proof-of-concept, making future exploit development plausible.