EUVD-2026-42187
GHSA-x96h-38x4-vxv6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF via phishing
-
DeliveryUser opens file in Foxit
-
ExploitEmbedded JS deletes page objects
-
ExecutionStale write to pop-up annotation
-
PersistUse-after-free memory corruption
-
ImpactCrash or code execution in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted PDF (UI:R) in a vulnerable local installation of Foxit PDF Reader or Editor; the malicious file must contain embedded JavaScript that deletes page objects, so JavaScript execution must be enabled in the application (it is enabled by default). No authentication or elevated privileges are needed (PR:N). Limiting factors: the attack is not remote/unattended - it depends entirely on user interaction to open the file, and disabling JavaScript Actions in Foxit preferences neutralizes the described trigger, meaning non-default hardened configurations are not exploitable via this path. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a local attack vector requiring user interaction (opening a file) but no privileges, with high impact across confidentiality, integrity, and availability - consistent with a use-after-free that can escalate from a crash to code execution. No EPSS score, KEV listing, POC, or SSVC decision was provided, so real-world exploitation pressure cannot be quantified from the input. Note a tension worth flagging: the description only demonstrates a program crash (denial of service), while the vendor-assigned CVSS asserts full C/I/A impact typical of exploitable memory corruption - the RCE potential is plausible for UAF but not explicitly confirmed by the description. Because exploitation requires social engineering (a user must open a malicious PDF), this is a meaningful but not drive-by remote risk; prioritize based on the large Foxit install base rather than any confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker crafts a PDF with embedded JavaScript that deletes page objects and emails it to a target or hosts it on a website. When the victim opens the document in a vulnerable Foxit PDF Reader or Editor, the stale annotation write triggers the use-after-free, crashing the application and potentially allowing the attacker to execute code in the victim's session. No public POC is known, but the local, user-interaction-driven vector fits typical malicious-document phishing campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1/14.0.4 and earlier) allows a crafted PDF containing embedded JavaScript to free page objects and trigger a dangling write to pop-up annotation objects. An attacker who convinces a user to open a malicious document can crash the application and potentially achieve arbitrary code execution in the user's context. No public exploit identified at time of analysis; the flaw was reported privately by Foxit.
RemediationAI
Patch available per vendor advisory - upgrade Foxit PDF Reader and Foxit PDF Editor to the latest release published on the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html); an exact fixed version was not included in the available data, so confirm the patched build against that bulletin (fixes will be later than 2026.1.1 for Reader/Editor and later than 14.0.4 for Editor 14.x). As a compensating control until patching, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly removes the trigger described here at the cost of breaking interactive/dynamic PDF forms; additionally enable Safe Reading Mode and avoid opening PDFs from untrusted sources or via email. These controls reduce the attack surface but do not remediate the underlying use-after-free.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in Foxit's PDF rendering engine and its embedded JavaScript execution environment (Foxit implements the Acrobat/PDF JavaScript API for interactive documents). Per CWE-416 (Use After Free), embedded JavaScript in the PDF deletes page objects, invalidating them, while the application retains and later dereferences stale pointers to associated pop-up annotation objects during a write operation. The affected CPEs are cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor. This is a classic document-parser lifetime-management bug: JavaScript-driven mutation of the document object model desynchronizes the annotation subsystem from the underlying page structure.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L) with required user interaction (UI:R) and no privileges (PR:N); use-after-free supports high C/I/A, though description directly evidences only the availability crash.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Reader and Editor (versions 2026.1.1/14.0.4 and earlier) contain a memory corruption vulnerability allowing arbitrary code execution when users open specially crafted PDF documents. Any employee or system using these tools faces potential compromise, data theft, and operational disruption without immediate risk mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable JavaScript in PDF reader settings; (2) restrict external PDF document access via email and network controls; (3) implement application whitelisting to limit reader capabilities; (4) deploy endpoint detection to identify exploitation patterns; (5) consider temporary suspension of Foxit use in high-risk departments pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB