Foxit PDF Editor EUVD-2026-42203

Exploitation requires the victim to open an attacker-supplied PDF (UI:R) in Foxit PDF Editor or Reader on the local machine (AV:L), and the malicious file must contain a cloud-style (cloudy) annotation/appearance whose construction parameters exceed the code's assumed bounds - that specific appearance feature is the trigger. No authentication is needed to deliver the file (PR:N), but the attack is bounded by the requirement for user interaction, local file handling rather than remote/network delivery, and the presence of the vulnerable Foxit product; it does not affect non-Foxit viewers.

The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the signals conflict: the vector asserts full confidentiality and integrity impact, while the description and the 'Denial Of Service' tag indicate only an application crash, so the C:H/I:H rating appears inflated for what is documented as an availability issue - verify true impact with the vendor. Attack vector is local with required user interaction (opening a file), which meaningfully limits mass exploitation compared to a network-facing bug. No EPSS score, KEV entry, POC, or SSVC decision data was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net real-world priority is moderate: patch in the normal cycle, treat primarily as a stability/DoS risk rather than a confirmed code-execution threat unless Foxit's bulletin states otherwise.

An attacker emails or hosts a specially crafted PDF whose cloud-style annotation appearance encodes an oversized or inconsistent element count. When a victim opens it in Foxit PDF Editor or Reader (AV:L/UI:R), the appearance-construction code performs an out-of-bounds array access and the application crashes. No public proof-of-concept has been identified at time of analysis.