This vulnerability involves a use-after-free condition (CWE-416) triggered by a specially crafted XFA PDF during the calculate event processing in Foxit PDF Editor. When the application processes such a PDF, it may access memory after it has been freed, leading to a crash and the possibility of executing arbitrary code. The affected versions include 2026.1 and earlier, and 14.0.3 and earlier. The CVSS 3.1 base score is 5.5, reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability (application crash). No patch or official remediation level has been disclosed by Foxit Software Inc. as of the publication date.

Successful exploitation can cause the Foxit PDF Editor application to crash and may allow an attacker to execute arbitrary code on the affected system. The attack requires local access and user interaction. The impact is primarily on availability and potentially on code execution, but confidentiality and integrity are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening XFA PDFs from untrusted sources and consider restricting access to vulnerable versions of Foxit PDF Editor. Monitor the vendor's website for updates or patches addressing this vulnerability.