What is the CVSS score of CVE-2026-13129?

CVE-2026-13129 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-13129?

Foxit PDF Reader and Editor (versions through 2026.1.1, 13.2.4, and 14.0.4) contain a memory corruption vulnerability that crashes the application when users open malicious PDFs, disrupting document…

How to fix or mitigate CVE-2026-13129?

Within 24 hours: Disable JavaScript execution in all Foxit PDF Reader and Editor installations organization-wide; identify systems running affected versions and restrict PDF access to trusted sources only. Within 7 days: Contact Foxit directly for patch availability timeline and document current affected inventory. Within 30 days: Apply vendor patch upon release or migrate to an alternative PDF reader if Foxit does not release timely fixes.

Foxit PDF Reader CVE-2026-13129

EUVD-2026-42182 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-7j37-5f9j-vw6q

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector with required user interaction and no privileges; use-after-free memory corruption plausibly yields high CIA impact, though the described outcome is a crash (A:H is certain, C:H/I:H reflects UAF potential).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:17 vuln.today

DescriptionCVE.org

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.

AnalysisAI

Memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1, 13.2.4, 14.0.4 and earlier) allows attackers to crash the application and potentially corrupt memory when a victim opens a malicious PDF whose embedded JavaScript walks a deliberately damaged form-field tree. The bug is a use-after-free (CWE-416): field traversal leaves the program holding a freed/invalid form object, and dereferencing that invalid pointer causes the crash. No public exploit identified at time of analysis; disclosure originates from Foxit's own security bulletin.

Technical ContextAI

The affected technology is Foxit's PDF rendering engine and its embedded JavaScript interpreter, which exposes the AcroForm field object model (the 'field property path' / field tree) to script inside a document. A malformed field tree causes JavaScript-driven field traversal to reference a form object that has already been freed, the classic root cause of CWE-416 (Use After Free): an object's lifetime is not correctly tied to the references still pointing at it, so a subsequent property access reads through a dangling pointer. Per the CPE data the exact affected products are cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor. Because a freed object may be reallocated with attacker-influenced data, UAF conditions frequently escalate from simple crashes to controlled memory corruption, which is consistent with the vendor's Memory Corruption tag and the high CIA impact in the CVSS vector.

RemediationAI

No vendor-released fix version was included in the provided data, so the exact patched build could not be independently confirmed - consult Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html and upgrade Foxit PDF Reader and Foxit PDF Editor to the latest release above the affected 2026.1.1 / 13.2.4 / 14.0.4 branches as soon as the patched version is published. As an immediate compensating control, disable JavaScript execution in Foxit (Preferences > JavaScript > uncheck 'Enable JavaScript Actions'), which breaks the field-traversal trigger; the trade-off is that legitimate interactive/dynamic forms and JavaScript-driven document features will no longer work. Additionally, open untrusted PDFs in Foxit's Safe Reading Mode and enforce opening documents from unknown sources only in a sandboxed or isolated environment, and use mail/web gateway filtering to strip or quarantine PDFs from untrusted senders - at the cost of some user friction and potential false positives.