CVE-2023-27363: Foxit PDF Reader exportXFAData exposed method allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.8 with user interaction but high EPSS and arbitrary code execution impact make this a high-priority patch for Foxit users.

What it is

Foxit PDF Reader exposes a JavaScript interface in the exportXFAData method that permits writing arbitrary files. Because the exposed method is reachable from document JavaScript, an attacker can turn a crafted PDF or malicious page into arbitrary file writes and code execution. The flaw is a CWE-749 exposed dangerous method in a widely deployed PDF reader.

Impact

An attacker gains arbitrary code execution in the context of the current user, including the ability to write files to attacker-chosen paths. This can lead to full user-level compromise of the host.

Attack surface

Reached locally through the application's JavaScript interface when the target opens a malicious PDF or visits a malicious page; user interaction is required and no privileges are needed per the CVSS vector. No authentication is required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.47 (98.8th percentile), indicating elevated likelihood of exploitation activity. References are vendor and ZDI advisories only, with no public exploit tag.

What to do

• Update Foxit PDF Reader and PDF Editor to the fixed version listed in the Foxit security bulletin.
• Disable JavaScript execution in Foxit PDF Reader where operationally feasible.
• Block or restrict untrusted PDF attachments and web-hosted PDFs at the email and web gateway.
• Run PDF readers with least privilege and consider application sandboxing or containment.
• Monitor Foxit security bulletins for further updates on this issue.

Detection

• Monitor for unexpected file creation or modification by Foxit processes in user-writable and system directories.
• Alert on Foxit PDF Reader spawning child processes such as cmd.exe, powershell.exe or script interpreters.
• Review endpoint logs for PDF files opened from email attachments or browser downloads immediately preceding suspicious file writes.
• Hunt for anomalous JavaScript-triggered behavior in PDF readers using EDR process and file telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.