This vulnerability in Foxit PDF Editor involves parsing logic flaws that cause improper input validation (CWE-20). Specifically, malformed form field hierarchies can trick the software into treating non-signature data as valid signatures. This misidentification results in invalid memory writes and program crashes during the construction of internal data structures. The issue affects versions 2026.1 and earlier, and 14.0.3 and earlier. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability. The product is cloud-hosted, and a patch is available though no direct patch links are provided. No known exploits in the wild have been reported.

Successful exploitation can lead to invalid memory writes and program crashes, potentially causing denial of service and compromising confidentiality and integrity of data processed by Foxit PDF Editor. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

A patch is available for this vulnerability. Since Foxit PDF Editor is a cloud service, the vendor typically manages remediation server-side. Users should verify with Foxit's official advisory or support channels that their service instance has been updated to the patched version. No additional user action is required if the vendor confirms mitigation.