What is the CVSS score of CVE-2026-13126?

CVE-2026-13126 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-13126?

Foxit PDF Reader and Editor (versions 2026.1.1/14.0.4 and earlier) contain a memory corruption vulnerability allowing arbitrary code execution when users open specially crafted PDF documents.

How to fix or mitigate CVE-2026-13126?

24 hours: Inventory all Foxit installations; block PDF opening from untrusted sources via email gateways and endpoint policy. 7 days: Disable JavaScript execution in Foxit PDF settings organization-wide; establish formal prohibition on opening PDFs from external senders without IT review; monitor Foxit security advisories for patch release. 30 days: Migrate to alternative PDF readers (Adobe Reader, Sumatra PDF) or implement formal risk exception with enhanced endpoint detection/response monitoring if business requirements mandate continued Foxit use.

Foxit PDF Reader CVE-2026-13126

EUVD-2026-42187 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-x96h-38x4-vxv6

Memory Corruption Denial Of Service Use After Free Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector (AV:L) with required user interaction (UI:R) and no privileges (PR:N); use-after-free supports high C/I/A, though description directly evidences only the availability crash.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:21 vuln.today

DescriptionCVE.org

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1/14.0.4 and earlier) allows a crafted PDF containing embedded JavaScript to free page objects and trigger a dangling write to pop-up annotation objects. An attacker who convinces a user to open a malicious document can crash the application and potentially achieve arbitrary code execution in the user's context. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deliver crafted PDF via phishing

Delivery

User opens file in Foxit

Exploit

Embedded JS deletes page objects

Execution

Stale write to pop-up annotation

Persist

Use-after-free memory corruption

Impact

Crash or code execution in user context

Access

Deliver crafted PDF via phishing

Delivery

User opens file in Foxit

Exploit

Embedded JS deletes page objects

Execution

Stale write to pop-up annotation

Persist

Use-after-free memory corruption

Impact

Crash or code execution in user context

Vulnerability AssessmentAI

Exploitation	Exploitation requires a victim to open an attacker-crafted PDF (UI:R) in a vulnerable local installation of Foxit PDF Reader or Editor; the malicious file must contain embedded JavaScript that deletes page objects, so JavaScript execution must be enabled in the application (it is enabled by default). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a local attack vector requiring user interaction (opening a file) but no privileges, with high impact across confidentiality, integrity, and availability - consistent with a use-after-free that can escalate from a crash to code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a PDF with embedded JavaScript that deletes page objects and emails it to a target or hosts it on a website. When the victim opens the document in a vulnerable Foxit PDF Reader or Editor, the stale annotation write triggers the use-after-free, crashing the application and potentially allowing the attacker to execute code in the victim's session. …
Remediation	Patch available per vendor advisory - upgrade Foxit PDF Reader and Foxit PDF Editor to the latest release published on the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html); an exact fixed version was not included in the available data, so confirm the patched build against that bulletin (fixes will be later than 2026.1.1 for Reader/Editor and later than 14.0.4 for Editor 14.x). … Detailed patch versions, workarounds, and compensating controls in full report.