EUVD-2026-42195
GHSA-x84g-p925-fhwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious PDF via phishing
-
DeliveryVictim opens document in Foxit
-
ExploitEmbedded JS resets form
-
ExecutionRe-entrant traversal frees control object
-
PersistDangling pointer dereferenced
-
ImpactApplication crash or code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied PDF (UI:R, AV:L) in an affected Foxit PDF Editor (≤14.0.4) or Foxit PDF Reader (≤2026.1.1) build, and requires that JavaScript execution be enabled in the reader - the trigger is specifically a form-reset action performed by embedded document JavaScript that re-enters the synchronization/traversal routine. No authentication or pre-existing privileges are needed (PR:N). The principal limiting factors are the mandatory user interaction (a user must be socially engineered into opening the document), the local delivery requirement, and the dependency on Foxit's JavaScript feature being active - environments that disable PDF JavaScript or use Safe Reading Mode substantially reduce the attack surface. |
| Impact | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector requiring user interaction - the realistic delivery is a malicious PDF that the victim opens - with no prior privileges needed and low attack complexity. There is a notable tension in the data: the description characterizes the outcome only as an application crash (denial of service), and the tags list 'Denial Of Service' alongside 'Use After Free'/'Memory Corruption', yet the CVSS assigns full C:H/I:H/A:H, which implies code-execution potential rather than a pure crash. This should be verified with Foxit; if the true impact is DoS-only, the confidentiality/integrity metrics are overstated. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so there is no evidence of active or imminent exploitation. Net assessment: a credible, patch-worthy client-side memory-corruption bug in widely deployed PDF software, but its priority is tempered by the requirement for user interaction and the absence of any exploitation signal - handle as a routine-but-important workstation patch rather than an emergency. |
| Exploit ScenarioDerived | An attacker crafts a PDF whose embedded JavaScript resets a form and delivers it via phishing email or a malicious download. When the victim opens the document in a vulnerable Foxit PDF Editor or Reader build, the form-reset routine frees an object still referenced by an in-progress traversal, and the subsequent dangling-pointer dereference crashes the application - with potential for controlled memory corruption leading to code execution given the vendor's C:H/I:H/A:H rating. No public proof-of-concept has been identified, and the low attack complexity (AC:L) means a working exploit would be reliable once developed, though user interaction (UI:R) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Foxit, the reporting vendor, has issued a security bulletin covering the affected versions.
RemediationAI
Patch available per vendor advisory: upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed release listed on Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html (a specific fixed version number was not included in the provided data and should be taken directly from that bulletin - do not assume a version). Because exploitation depends on embedded form-reset JavaScript, an effective compensating control while patching is to disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which neutralizes this specific vector at the cost of breaking legitimate interactive/AcroForm and dynamic PDF workflows. Additionally, enable Foxit's Safe Reading Mode / sandbox protections and block or quarantine PDFs from untrusted external sources at the email and web gateway. Avoid opening PDFs from unknown senders until the update is deployed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in the JavaScript-driven form handling engine of Foxit's PDF rendering stack, shared across both the Editor and Reader products (per CPE cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader). PDF documents can embed JavaScript that manipulates AcroForm fields; when a script resets the form, the internal synchronization/traversal routine lacks re-entry protection and object lifecycle verification, so an object referenced by a control pointer can be freed while a traversal is still in progress. The code then continues to dereference the now-dangling pointer. Use-after-free conditions are a classic memory-corruption primitive: at minimum they cause deterministic crashes (denial of service), and depending on heap grooming they can escalate to controlled writes and code execution, which is consistent with the vendor's high confidentiality/integrity/availability rating.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local crafted-file vector needing the user to open a PDF (AV:L/UI:R), no privileges (PR:N); UAF memory corruption justifies high C/I/A per vendor, though DoS-only impact is plausible.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in the failure of the control pointer during the traversal process. After the pointer fails, it still continues to dereference, causing the application to crash.
Executive ViewAI
Foxit PDF Editor and Reader (versions through 14.0.4 and 2026.1.1 respectively) contain a use-after-free vulnerability allowing code execution when users open malicious PDF documents. Any employee relying on these products to view potentially compromised files faces risk of application compromise and unauthorized data access. With no patch currently available, immediate protective controls and vendor monitoring are critical to prevent widespread exposure.
Disable JavaScript in Foxit PDF Reader/Editor settings (eliminates primary attack vector); implement mail gateway filtering and web controls to restrict PDF delivery from untrusted sources; enforce application sandboxing (Windows Sandbox, macOS Gatekeeper, or OS-level containerization) to limit execution scope if compromise occurs; configure endpoint monitoring to alert on Foxit process crashes or suspicious behavior; restrict user file-execution privileges to prevent post-compromise lateral movement. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB