A critical vulnerability in Foxit PDF Editor and Reader caused by improper input validation during signature verification could allow an attacker to compromise system integrity.

The application fails to perform adequate argument validation when processing abnormally constructed objects. An attacker can leverage JavaScript to trigger signature verification, where the plugin fails to validate string copying, resulting in a buffer copy error (CWE-120).

The CVSS score of 7.8 (High) reflects the potential for complete impact on confidentiality, integrity, and availability. Successful exploitation requires user interaction but could lead to unauthorized code execution, resulting in full system compromise, data theft, or service disruption for the affected workstation.

Immediate Action: Update to the latest version of Foxit PDF Editor or Reader as provided by the vendor’s official security bulletin.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unauthorized attempts to execute scripts within PDF documents.

Compensating Controls: Disable JavaScript in PDF settings across the enterprise to prevent the triggering of automated malicious scripts until patches are applied.

Public Exploit Available: false

Given the high severity of this buffer-related vulnerability, administrators should prioritize the deployment of vendor-supplied updates. If an immediate update is not feasible, restricting the execution of JavaScript in PDF documents is strongly recommended to reduce the attack surface.