EUVD-2026-42185
GHSA-v4qp-8g92-cj69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF to victim
-
DeliveryUser opens file in Foxit
-
ExploitEmbedded JavaScript deletes page
-
ExecutionLater script accesses freed view properties
-
ImpactUse-after-free triggers application crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted PDF in Foxit PDF Reader or PDF Editor (version 2026.1.1 or earlier) with JavaScript execution enabled (Foxit's default), where the embedded script must first delete a page and then have subsequent scripts access the freed document-view properties. Limiting factors: the CVSS vector is AV:L with UI:R, so there is no remote or unauthenticated network trigger - an attacker cannot fire this without user action, and disabling JavaScript in Foxit fully prevents the trigger. Exploitation is confined to Foxit's desktop products on affected versions and does not apply to viewers using other PDF engines. |
| Impact | Signals are mixed. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) rates full confidentiality/integrity/availability impact, but the description only substantiates an application crash (availability) - the C:H/I:H portion is not supported by the described behavior and appears to reflect a conservative treatment of use-after-free as potentially exploitable for code execution; verify with Foxit before treating this as confirmed RCE. Attack vector is Local with user interaction required (the victim must open a malicious file), which materially lowers real-world risk versus a network-reachable flaw. No EPSS score, SSVC decision, or POC was provided; it is absent from CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-worthy client-side memory-corruption issue, but not an emergency - priority should track whether Foxit or independent analysis confirms the flaw is exploitable beyond a crash. |
| Exploit ScenarioDerived | An attacker emails or hosts a booby-trapped PDF and lures a user of Foxit PDF Reader/Editor 2026.1.1 or earlier into opening it; the document's embedded JavaScript deletes a page and then references the freed document-view properties, crashing the application (a use-after-free). No public POC was provided, and because the vector is local with required user interaction, exploitation depends entirely on convincing the victim to open the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Denial-of-service in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1 and earlier) occurs when a victim opens a crafted PDF whose embedded JavaScript deletes the current page, after which subsequent scripts dereference now-freed document-view properties and crash the application. This is a CWE-416 use-after-free reported by Foxit; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The documented impact is an application crash, though the underlying memory-corruption class warrants caution about potential escalation.
RemediationAI
Update to a Foxit-released version newer than 2026.1.1 for both PDF Reader and PDF Editor; the exact fixed build should be confirmed against Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html, as no specific fixed version was provided in this data (Patch available per vendor advisory; exact fix version not independently confirmed). As a compensating control until patched, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly neutralizes this script-driven use-after-free at the cost of breaking legitimate interactive/form PDFs that rely on scripting; additionally, treat PDFs from untrusted sources with caution and enable Foxit's Safe Reading Mode to constrain script and external actions. Because exploitation requires the user to open a malicious file, user-awareness and blocking untrusted PDF delivery channels (email, web downloads) further reduce exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Foxit's PDF rendering engine and its embedded JavaScript interpreter, which lets PDF documents script the viewer's document-view object model (e.g., page and view properties). The root cause is CWE-416 (Use After Free): JavaScript in the PDF programmatically deletes a page, freeing the objects backing that page's view state, but subsequent script execution continues to reference those freed document-view properties. Per the supplied CPE data, exactly two products are in scope - cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor - both of which share Foxit's common core engine, which is why a single flaw affects both the free reader and the paid editor.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector requiring the user to open the PDF (AV:L, UI:R); described impact is only an application crash, so A:H with C:N/I:N.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Reader and Editor (versions 2026.1.1 and earlier) are vulnerable to denial-of-service attacks triggered by malicious PDF documents, causing application crashes and work interruptions. No public exploit code has been identified at time of analysis, though the underlying use-after-free memory corruption warrants immediate mitigation to prevent operational disruption and reduce escalation risk.
No vendor-released patch identified at time of analysis. Interim mitigations: disable JavaScript execution in Foxit products; restrict PDF file sources to trusted internal origins; implement endpoint execution policies; consider sandboxed PDF viewers for external or untrusted documents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB