What is the CVSS score of CVE-2026-18622?

CVE-2026-18622 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Foxit PDF Editor CVE-2026-18622

EUVD-2026-57737 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-08-13 14984358-7092-470d-8f34-ade47a7658a2

GHSA-9462-v678-qmwm

Information Disclosure Pdf Reader Pdf Editor Foxit

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

4.7 MEDIUM

Exploitation requires user to open a locally processed crafted document and non-trivial PDF manipulation skill (AC:H); integrity impact is high due to forged trust signal, with no confidentiality or availability effect.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Sep 10, 2026 - 17:07 NVD

4.7 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 07:31 vuln.today

DescriptionNVD

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of signatures.

AnalysisAI

Foxit PDF Editor and Foxit PDF Reader fail to consistently alert users when digital signature fields are manipulated - including alterations to field appearance streams, coordinate repositioning, or field duplication within a document. An attacker who delivers a specially crafted PDF to a target can exploit the flawed UI feedback to make a tampered document appear validly signed, directly undermining the integrity assurance that digital signatures exist to provide. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes conditions where the software's UI fails to accurately convey the security or integrity state of data presented to the user. In PDF digital signature workflows, the visual trust indicator - a checkmark, banner, or seal rendered by the viewer - is the primary and often sole signal that non-technical users rely on to assess document authenticity. Foxit PDF Editor and Reader use signature field metadata and rendering heuristics to determine when to surface integrity warnings. This vulnerability arises when specific manipulations - coordinate repositioning of signature fields over different document regions, substitution of appearance streams, or cloning of signature fields - fall outside those detection heuristics, causing the application to render the document without triggering a validation alert. The net effect is that the PDF viewer's trust UI is decoupled from the actual cryptographic integrity state of the document. No CPE strings were included in the provided dataset; exact affected version ranges must be confirmed via the Foxit security bulletins.

RemediationAI

Consult Foxit's official security bulletins at https://www.foxit.com/support/security-bulletins.html to identify the patched release version; no specific fix version number was included in the available intelligence data, so a patch is available per vendor advisory but the exact version is not independently confirmed. Apply the vendor-recommended update to Foxit PDF Editor or Foxit PDF Reader as directed. As a compensating control where immediate patching is impractical, organizations that rely on Foxit for signature verification in high-trust workflows - contracts, legal filings, regulatory submissions - should enforce out-of-band signature validation using an independent verification tool or service before treating any signed document as authoritative; this eliminates reliance on Foxit's UI-layer trust signal until the patch is confirmed deployed. User awareness training is a supplementary but not standalone control: staff should be informed not to base binding decisions solely on Foxit's visual signature indicator.