What is the CVSS score of CVE-2026-13126?

CVE-2026-13126 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-13126?

Foxit PDF Reader and Editor (versions 2026.1.1/14.0.4 and earlier) contain a memory corruption vulnerability allowing arbitrary code execution when users open specially crafted PDF documents.

How to fix or mitigate CVE-2026-13126?

24 hours: Inventory all Foxit installations; block PDF opening from untrusted sources via email gateways and endpoint policy. 7 days: Disable JavaScript execution in Foxit PDF settings organization-wide; establish formal prohibition on opening PDFs from external senders without IT review; monitor Foxit security advisories for patch release. 30 days: Migrate to alternative PDF readers (Adobe Reader, Sumatra PDF) or implement formal risk exception with enhanced endpoint detection/response monitoring if business requirements mandate continued Foxit use.

Foxit PDF Reader CVE-2026-13126

EUVD-2026-42187 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-x96h-38x4-vxv6

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector (AV:L) with required user interaction (UI:R) and no privileges (PR:N); use-after-free supports high C/I/A, though description directly evidences only the availability crash.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:21 vuln.today

DescriptionCVE.org

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1/14.0.4 and earlier) allows a crafted PDF containing embedded JavaScript to free page objects and trigger a dangling write to pop-up annotation objects. An attacker who convinces a user to open a malicious document can crash the application and potentially achieve arbitrary code execution in the user's context. No public exploit identified at time of analysis; the flaw was reported privately by Foxit.

Technical ContextAI

The vulnerability lies in Foxit's PDF rendering engine and its embedded JavaScript execution environment (Foxit implements the Acrobat/PDF JavaScript API for interactive documents). Per CWE-416 (Use After Free), embedded JavaScript in the PDF deletes page objects, invalidating them, while the application retains and later dereferences stale pointers to associated pop-up annotation objects during a write operation. The affected CPEs are cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor. This is a classic document-parser lifetime-management bug: JavaScript-driven mutation of the document object model desynchronizes the annotation subsystem from the underlying page structure.

RemediationAI

Patch available per vendor advisory - upgrade Foxit PDF Reader and Foxit PDF Editor to the latest release published on the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html); an exact fixed version was not included in the available data, so confirm the patched build against that bulletin (fixes will be later than 2026.1.1 for Reader/Editor and later than 14.0.4 for Editor 14.x). As a compensating control until patching, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly removes the trigger described here at the cost of breaking interactive/dynamic PDF forms; additionally enable Safe Reading Mode and avoid opening PDFs from untrusted sources or via email. These controls reduce the attack surface but do not remediate the underlying use-after-free.