ZDI-26-732: Foxit PDF Reader importIcon NTLM Response Information Disclosure Vulnerability

Foxit PDF Editor and Reader fail to enforce permission verification for Secure Reading Mode, a protection mechanism failure (CWE-693) that lets a malicious PDF silently trigger an outbound SMB authentication request without any security prompt. When a victim simply opens the crafted PDF, their Windows machine sends NTLM authentication responses (per the related ZDI advisory, via a construct such as the importIcon action) to an attacker-controlled SMB server, exposing the user's credential hash, which can be cracked offline or relayed for lateral movement. The flaw requires user interaction but no privileges, and affects both the free Reader and paid Editor products; per the CVSS vector, availability is also impacted (A:H). No public proof of concept is known and there is no evidence of in-the-wild exploitation, though the attack is trivially deliverable via emailed or downloaded PDFs.