A heap-based out-of-bounds read vulnerability in Foxit PDF Editor and Reader poses a significant risk of service disruption via application crashing.

This is a heap-based out-of-bounds read vulnerability (CWE-125) triggered during the decoding of malformed PDF image objects. The flaw requires user interaction to open a malicious file, and it is accessible to unauthenticated local users.

The vulnerability primarily impacts system availability by causing the Foxit PDF application to crash. While the CVSS score of 6.1 indicates a medium severity, the potential for denial-of-service in critical document-heavy workflows can lead to productivity loss and operational disruption.

Immediate Action: Users should update their installation to the latest available version provided by the vendor at the official support portal.

Proactive Monitoring: Security teams should monitor endpoint logs for recurring application crashes or unexpected terminations associated with the PDF rendering process.

Compensating Controls: Deploy endpoint protection software capable of detecting malicious file structures or abnormal process behavior to mitigate risks from untrusted documents.

Public Exploit Available: Unknown

Organizations should prioritize patching Foxit PDF Editor and Reader to the latest versions to eliminate the underlying out-of-bounds read condition. Given the nature of PDF-based attacks, users should also exercise caution when opening documents from untrusted sources until the software has been updated.