EUVD-2026-42186
GHSA-c9gg-rhrr-vvmx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF to victim
-
DeliveryVictim opens file in Foxit
-
ExploitJavaScript rewrites page structure, frees page objects
-
ExecutionThumbnail renderer dereferences freed objects
-
ImpactUse-after-free triggers crash / potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open a maliciously crafted PDF in Foxit PDF Editor or Foxit PDF Reader, and requires Foxit's JavaScript execution to be enabled (the default) so the embedded script can rewrite the document's page structure at runtime; the thumbnail/preview rendering path must also engage the freed page objects. Exploitation is LIMITED by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the attack cannot fire without a user actively opening the attacker-supplied file - and is neutralized if JavaScript actions are disabled in preferences. This is not remote, unauthenticated, or automatable exploitation against a listening service. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8, High) describes a local attack vector requiring user interaction but no privileges, with high impact to confidentiality, integrity and availability. There is a tension worth flagging: the description only demonstrates an application crash (a denial-of-service outcome), yet the vendor-assigned vector claims full C:H/I:H - this is typical for use-after-free bugs, where the demonstrated crash is often a conservative floor and controlled memory reuse could escalate to code execution, but confidentiality/integrity impact here is inferred from the UAF class rather than proven in the description. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input. Real-world priority is moderate: exploitation is not remote or automatable (the user must open a malicious file), which lowers wormability, but the very large install base of Foxit and the low attack complexity make it a worthwhile patch for endpoints that process untrusted PDFs. |
| Exploit ScenarioDerived | An attacker emails or hosts a booby-trapped PDF containing JavaScript that deletes or reorders pages after load; when the victim opens it in Foxit PDF Editor or Reader, the thumbnail renderer dereferences the freed page objects and the application crashes (denial of service), with a use-after-free primitive that a skilled attacker could potentially shape toward code execution. Exploitation requires local user interaction (opening the file) and no authentication; no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Denial-of-service (and potential memory-corruption) in Foxit PDF Editor (≤14.0.4 / ≤13.2.4 / ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) arises when a crafted PDF's embedded JavaScript rewrites the document to alter the page structure, freeing the underlying page objects while the thumbnail renderer continues to reference them - a classic use-after-free (CWE-416). A victim who merely opens the file triggers the dangling reference, causing an application crash and, given the CVSS confidentiality/integrity impact, a plausible path to code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified in the provided data; the reference points only to Foxit's security bulletin index at https://www.foxit.com/support/security-bulletins.html, so consult that page for the exact fixed build and upgrade Foxit PDF Editor and Foxit PDF Reader to the latest release above the affected versions (14.0.4 / 13.2.4 / 2026.1.1). As a compensating control until patched, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly removes the script-driven page-restructuring trigger at the cost of breaking legitimate interactive/form PDFs. Additionally, avoid opening PDFs from untrusted sources and consider disabling the thumbnail panel or using Foxit's protected/safe-reading mode to reduce exposure of the vulnerable rendering path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in Foxit's PDF rendering engine, specifically the interaction between its embedded JavaScript interpreter (which can programmatically manipulate document/page structure at runtime via the PDF JavaScript API) and the thumbnail generation subsystem. When JavaScript deletes or restructures pages, the page objects are deallocated, but cached thumbnail entries retain raw pointers to the now-freed objects. Dereferencing those stale pointers is a textbook CWE-416 Use-After-Free, the root cause class behind the vendor's own 'Denial Of Service / Use After Free / Memory Corruption' tagging. The affected products are identified by CPE as cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader, both desktop PDF applications with full scripting support.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector (AV:L) needing a user to open the PDF (UI:R) with no privileges (PR:N); use-after-free plausibly enables code execution so C/I/A rated H, though demonstrated impact is a crash.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and PDF Reader contain a use-after-free vulnerability enabling potential remote code execution when opening crafted PDF files; no public exploit identified at time of analysis. The minimal barrier to exploitation creates significant operational and data security risk for organizations with Foxit deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable JavaScript in Foxit settings where available; (2) Deploy email gateway scanning to quarantine PDF attachments from external senders; (3) Restrict Foxit file execution privileges for non-administrative users; (4) Implement EDR tuning for abnormal Foxit terminations and memory anomalies; (5) Conduct user security awareness training on risks of unsolicited PDF files; (6) Sandbox or containerize Foxit instances in high-risk user populations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB