What is the CVSS score of CVE-2026-13127?

CVE-2026-13127 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Editor are affected by CVE-2026-13127?

Foxit PDF Editor and PDF Reader contain a use-after-free vulnerability enabling potential remote code execution when opening crafted PDF files; no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-13127?

Within 24 hours: Inventory all Foxit PDF Editor and Reader installations (affected versions: Editor ≤14.0.4/≤13.2.4/≤2026.1.1; Reader ≤2026.1.1); alert users to avoid opening PDFs from untrusted sources. Within 7 days: Disable JavaScript execution in Foxit products if configuration permits; deploy endpoint detection tuning for abnormal Foxit process crashes or memory access violations. Within 30 days: Monitor Foxit security advisories for patch availability; develop migration plan to alternative PDF readers if patches remain unavailable.

Foxit PDF Editor CVE-2026-13127

EUVD-2026-42186 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-c9gg-rhrr-vvmx

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local malicious-file vector (AV:L) needing a user to open the PDF (UI:R) with no privileges (PR:N); use-after-free plausibly enables code execution so C/I/A rated H, though demonstrated impact is a crash.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:20 vuln.today

DescriptionCVE.org

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.

AnalysisAI

Denial-of-service (and potential memory-corruption) in Foxit PDF Editor (≤14.0.4 / ≤13.2.4 / ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) arises when a crafted PDF's embedded JavaScript rewrites the document to alter the page structure, freeing the underlying page objects while the thumbnail renderer continues to reference them - a classic use-after-free (CWE-416). A victim who merely opens the file triggers the dangling reference, causing an application crash and, given the CVSS confidentiality/integrity impact, a plausible path to code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw sits in Foxit's PDF rendering engine, specifically the interaction between its embedded JavaScript interpreter (which can programmatically manipulate document/page structure at runtime via the PDF JavaScript API) and the thumbnail generation subsystem. When JavaScript deletes or restructures pages, the page objects are deallocated, but cached thumbnail entries retain raw pointers to the now-freed objects. Dereferencing those stale pointers is a textbook CWE-416 Use-After-Free, the root cause class behind the vendor's own 'Denial Of Service / Use After Free / Memory Corruption' tagging. The affected products are identified by CPE as cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader, both desktop PDF applications with full scripting support.

RemediationAI

No vendor-released patch version was identified in the provided data; the reference points only to Foxit's security bulletin index at https://www.foxit.com/support/security-bulletins.html, so consult that page for the exact fixed build and upgrade Foxit PDF Editor and Foxit PDF Reader to the latest release above the affected versions (14.0.4 / 13.2.4 / 2026.1.1). As a compensating control until patched, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly removes the script-driven page-restructuring trigger at the cost of breaking legitimate interactive/form PDFs. Additionally, avoid opening PDFs from untrusted sources and consider disabling the thumbnail panel or using Foxit's protected/safe-reading mode to reduce exposure of the vulnerable rendering path.