Foxit PDF Editor allows PDF JavaScript and document/print actions (e.g., WillPrint/DidPrint) to modify form fields, annotations, or optional content groups immediately before or after redaction, encryption, or printing. Because these script-driven updates are not fully integrated into the redaction, encryption, and printing logic, under certain document structures and user workflows, sensitive information may remain exposed or printed output may not match the reviewed content. This results in an exposure of sensitive information to unauthorized actors. The vulnerability is tracked as CWE-200 (Exposure of Sensitive Information). It affects Foxit PDF Editor versions 2025.3 and earlier. The CVSS v3.1 base score is 4.7, indicating medium severity, with attack vector local, high attack complexity, no privileges required, user interaction required, and impact to confidentiality only.

The vulnerability can lead to unintended exposure of sensitive information due to incomplete redaction or encryption when PDF JavaScript or print actions update content immediately before or after these processes. This may cause some sensitive content to remain visible or unencrypted, or printed output to differ from what was reviewed on screen. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — no official fix or patch information is provided. Users should monitor Foxit Software Inc. advisories for updates. Until a patch is available, avoid using PDF JavaScript or document/print actions that update form fields, annotations, or optional content groups immediately before or after redaction, encryption, or printing to minimize exposure risk.