Foxit PDF Reader EUVD-2026-85129

Exploitation requires a victim to open an attacker-supplied specially crafted PDF in Foxit PDF Editor or Reader (UI:R), where JavaScript execution in the PDF is enabled so embedded scripts can modify annotation rich-text attributes with malformed font data; the use-after-free then triggers during automatic annotation appearance reconstruction. Limiting factors: mandatory user interaction (opening the file), the local/client attack vector (no network-remote trigger), and reliance on the PDF-scripting/annotation-rendering path being active. No authentication is required (PR:N). Demonstrated impact is a crash; full code execution is asserted by the vendor score but not evidenced in the description.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) reflects the standard client-side file-parsing archetype: 'local' attack vector because the victim must open a file, no privileges required, but mandatory user interaction (UI:R). There is a notable internal conflict worth surfacing: the description only claims a use-after-free that results in 'an application crash' (pure availability/DoS impact), and the input Tags lead with 'Denial Of Service', yet the vendor CVSS asserts full C:H/I:H/A:H. UAF conditions in PDF renderers are frequently escalatable to code execution, so the C:H/I:H may reflect worst-case exploitability rather than the demonstrated crash - this should be verified with Foxit, as the demonstrated impact (crash) and the scored impact (RCE-class) diverge. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active exploitation or public weaponization. Realistically this is a medium-priority patch item: exploitation is gated behind convincing a user to open a malicious PDF, and there is no exploitation signal, but Foxit's large install base and the RCE-consistent scoring warrant timely patching for organizations that process untrusted PDFs.

An attacker emails or hosts a specially crafted PDF whose embedded scripts modify annotation rich-text attributes with malformed font data; when the victim opens it in Foxit PDF Editor/Reader, the annotation appearance is reconstructed and accesses a freed object, triggering the use-after-free. The demonstrated outcome is an application crash, though the vendor scores full confidentiality/integrity/availability impact suggesting potential code execution; no public exploit code is identified at time of analysis.