What is the CVSS score of CVE-2026-13128?

CVE-2026-13128 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-13128?

Foxit PDF Reader and Editor (versions 2026.1.1 and earlier) are vulnerable to denial-of-service attacks triggered by malicious PDF documents, causing application crashes and work interruptions.

How to fix or mitigate CVE-2026-13128?

Within 24 hours: Disable JavaScript execution in Foxit PDF Reader and Editor via group policy; brief users to avoid untrusted PDFs; monitor support tickets for unexplained crashes. Within 7 days: Audit all Foxit instances for versions ≤2026.1.1; implement endpoint controls restricting Foxit launch from Downloads and email attachments; review Foxit vendor security advisories. Within 30 days: Monitor Foxit vendor advisories for patch release; prepare deployment package for immediate rollout; evaluate alternative PDF readers if remediation timeline extends.

Foxit PDF Reader CVE-2026-13128

EUVD-2026-42185 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-v4qp-8g92-cj69

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Local malicious-file vector requiring the user to open the PDF (AV:L, UI:R); described impact is only an application crash, so A:H with C:N/I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:18 vuln.today

DescriptionCVE.org

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

AnalysisAI

Denial-of-service in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1 and earlier) occurs when a victim opens a crafted PDF whose embedded JavaScript deletes the current page, after which subsequent scripts dereference now-freed document-view properties and crash the application. This is a CWE-416 use-after-free reported by Foxit; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The documented impact is an application crash, though the underlying memory-corruption class warrants caution about potential escalation.

Technical ContextAI

The affected technology is Foxit's PDF rendering engine and its embedded JavaScript interpreter, which lets PDF documents script the viewer's document-view object model (e.g., page and view properties). The root cause is CWE-416 (Use After Free): JavaScript in the PDF programmatically deletes a page, freeing the objects backing that page's view state, but subsequent script execution continues to reference those freed document-view properties. Per the supplied CPE data, exactly two products are in scope - cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor - both of which share Foxit's common core engine, which is why a single flaw affects both the free reader and the paid editor.

RemediationAI

Update to a Foxit-released version newer than 2026.1.1 for both PDF Reader and PDF Editor; the exact fixed build should be confirmed against Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html, as no specific fixed version was provided in this data (Patch available per vendor advisory; exact fix version not independently confirmed). As a compensating control until patched, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly neutralizes this script-driven use-after-free at the cost of breaking legitimate interactive/form PDFs that rely on scripting; additionally, treat PDFs from untrusted sources with caution and enable Foxit's Safe Reading Mode to constrain script and external actions. Because exploitation requires the user to open a malicious file, user-awareness and blocking untrusted PDF delivery channels (email, web downloads) further reduce exposure.