EUVD-2026-42195
GHSA-x84g-p925-fhwq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local crafted-file vector needing the user to open a PDF (AV:L/UI:R), no privileges (PR:N); UAF memory corruption justifies high C/I/A per vendor, though DoS-only impact is plausible.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in the failure of the control pointer during the traversal process. After the pointer fails, it still continues to dereference, causing the application to crash.
AnalysisAI
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-supplied PDF (UI:R, AV:L) in an affected Foxit PDF Editor (≤14.0.4) or Foxit PDF Reader (≤2026.1.1) build, and requires that JavaScript execution be enabled in the reader - the trigger is specifically a form-reset action performed by embedded document JavaScript that re-enters the synchronization/traversal routine. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector requiring user interaction - the realistic delivery is a malicious PDF that the victim opens - with no prior privileges needed and low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a PDF whose embedded JavaScript resets a form and delivers it via phishing email or a malicious download. When the victim opens the document in a vulnerable Foxit PDF Editor or Reader build, the form-reset routine frees an object still referenced by an in-progress traversal, and the subsequent dangling-pointer dereference crashes the application - with potential for controlled memory corruption leading to code execution given the vendor's C:H/I:H/A:H rating. … |
| Remediation | Patch available per vendor advisory: upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed release listed on Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html (a specific fixed version number was not included in the provided data and should be taken directly from that bulletin - do not assume a version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit enterprise Foxit installations (PDF Editor ≤14.0.4, PDF Reader ≤2026.1.1) and communicate vulnerability advisory to users; disable JavaScript execution in Foxit settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Foxit Pdf Editor
View allUse-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor lets a crafted PDF containing JavaScript trigg
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1/14.0.4 and earlier) allows
Denial-of-service (and potential memory-corruption) in Foxit PDF Editor (≤14.0.4 / ≤13.2.4 / ≤2026.1.1) and Foxit PDF Re
Denial-of-service in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1 and earlier) occurs when a victim opens a
Memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1, 13.2.4, 14.0.4 and earlier) allows attack
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF to trigger a use-after-free through the
Use-after-free memory corruption in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (through 14.0.4, 13.2.4
Memory corruption in Foxit PDF Reader (≤2026.1.1) and Foxit PDF Editor (≤14.0.4, ≤13.2.4, and ≤2026.1.1) allows an attac
Memory-corruption (buffer overflow) in Foxit PDF Reader and Foxit PDF Editor arises when the digital-signature plugin pr
Memory-corruption crash (and potential code execution) in Foxit PDF Reader and Foxit PDF Editor occurs when a PDF's embe
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to crash the application
Denial of service in Foxit PDF Editor and Foxit PDF Reader arises when the application renders a PDF containing cloud-st
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today