Foxit PDF Editor/Reader EUVD-2026-85126

Exploitation requires the victim to open a specially crafted PDF in Foxit PDF Editor or Foxit PDF Reader (UI:R user interaction is mandatory); the crafted document references an external SMB/UNC resource, and the flaw is that 'secure reading mode' fails to enforce its permission check, so the outbound authentication fires with no security prompt. No authentication or elevated privileges are needed on the target (PR:N). Practical impact is greatest where the client can reach an attacker-controlled SMB endpoint (e.g., Windows/Active Directory environments with outbound SMB/port 445 permitted); egress filtering that blocks outbound SMB substantially limits real-world exploitation, as does the requirement that a user actually open the malicious file.

This is a credential-hash disclosure (NTLM/SMB forced-authentication) flaw: a crafted PDF bypasses the missing permission check on Foxit's 'secure reading mode' and silently triggers outbound SMB authentication, leaking the user's NTLM credential hash without any prompt (CWE-693, Protection Mechanism Failure). Real-world risk is moderate: exploitation is gated by user interaction (the victim must open the malicious PDF), but requires NO authentication (PR:N) and NO special configuration once the PDF is opened, and it happens silently - a well-known, reliable attack class (cf. classic Adobe/Foxit NTLM-leak issues). No EPSS score, no CISA KEV listing, and no public PoC are provided in the input, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. The vendor CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H = 6.1) is internally inconsistent with the described impact: A:H (high availability impact) is unjustified for a pure hash-leak, and C:L understates the sensitivity of leaked credentials; the vector also appears copied from sibling Foxit memory-corruption CVEs. The described impact is confidentiality-only (credential disclosure), so verify the scoring with the vendor. Priority is elevated in enterprise Windows/AD environments where the leaked NTLMv2 hash enables offline cracking or NTLM relay for lateral movement.

An attacker emails or hosts a specially crafted PDF that references an attacker-controlled UNC/SMB path. When the victim opens it in Foxit PDF Editor/Reader, secure reading mode fails to block the request and the client silently authenticates to the attacker's SMB server, handing over the user's NTLM credential hash for offline cracking or relay. No public proof-of-concept is identified in the provided data, but this forced-authentication technique is well-established and reliable.