Foxit PDF Editor/Reader EUVD-2026-85127

Exploitation requires a victim to open an attacker-crafted PDF file in Foxit PDF Editor or Foxit PDF Reader with the FileOpen (DRM) plugin present and processing the malformed encryption metadata; execution occurs in the context of the local user. Limiting factors: mandatory user interaction (opening the file, UI:R), local attack vector (no remote/network-triggerable path), and the vendor's own 'potentially enabling' qualifier indicating code execution may not be reliably achievable versus a crash. No authentication or elevated privileges are needed on the attacker side.

This is a client-side file-parsing memory-corruption flaw in Foxit's FileOpen plugin, self-reported by Foxit. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: the local vector plus UI:R reflects the realistic delivery model where a victim must open a maliciously crafted PDF. CWE-822 (untrusted pointer dereference) leaving an internal pointer invalid, chained to read/write access violations, is a credible RCE primitive but the vendor language ('potentially enabling arbitrary code execution') signals code execution is not proven-reliable, which tempers the I:H/A:H claim. No EPSS score, no CISA KEV listing, and no public exploit code were provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is moderate: PDF-parser RCEs in widely deployed readers are historically attractive for phishing-driven initial access, but the requirement for user interaction and the absence of exploitation signals place this below drop-everything status. Key missing data: the single reference is a generic Foxit security-bulletins landing page with no fixed version, so patched builds cannot be independently confirmed from the input.

An attacker crafts a PDF with malformed encryption metadata that the FileOpen plugin mishandles, and emails or hosts it so a victim opens it in Foxit PDF Editor or Reader. Parsing leaves an internal pointer in an invalid state, producing chained read/write access violations that the attacker leverages toward arbitrary code execution in the context of the user running the application. No public proof-of-concept was provided; exploitation requires the victim to open the file (UI:R).