Foxit PDF Editor EUVD-2026-85119

Requires the victim to open a specially crafted PDF in Foxit PDF Editor or Reader that contains a Circle annotation with a malformed Cloudy appearance stream whose geometry passes insufficient validation. Exploitation is gated by mandatory user interaction (UI:R) - the file must be opened/rendered - and is local (AV:L), not remotely triggerable against a service. There is no privileged access requirement (PR:N), but the dependence on a user action and a non-standard, deliberately malformed annotation structure substantially limits practical, widespread exploitation.

This is a client-side, file-format memory-corruption bug (CWE-787 heap out-of-bounds write) triggered when Foxit PDF Editor/Reader renders a Circle annotation carrying a malformed 'Cloudy' appearance stream. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) correctly models this as local, low-complexity, unauthenticated but user-interaction-gated (the victim must open a crafted PDF). Note an internal tension in the data: the description only asserts 'memory corruption and application crashes' (an availability/DoS outcome), yet the vector claims full C:H/I:H/A:H. Heap OOB writes are a classic RCE primitive, so the high C/I ratings are plausible in principle, but the described impact is not independently corroborated as code execution - treat C:H/I:H as vendor-asserted potential rather than demonstrated. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. Real-world risk is moderate: exploitation depends entirely on social-engineering a user into opening a malicious document, and no weaponized exploit is known. Priority should be driven by Foxit's large install base rather than by any exploitation signal.

An attacker crafts a PDF containing a Circle annotation whose Cloudy appearance stream has malformed geometry and delivers it via email or a download link. When the victim opens the file in Foxit PDF Editor or Reader, the rendering path performs an out-of-bounds heap write, corrupting memory and at minimum crashing the application, with potential for attacker-controlled code execution. No public exploit code is currently identified, and successful exploitation requires the user to open the crafted file.