Description
Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.
Affected products
foxit: pdf editor; foxit: pdf reader; microsoft: windows
References1
- www.foxit.com/support/security-bulletins.html Vendor Advisory
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 2 · as of 9 November 2026
- CWE
- CWE-822
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.