EUVD-2026-42194
GHSA-v6wf-mgv3-6mx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF with abusive field structure
-
DeliveryDeliver via email or web to victim
-
ExploitVictim opens file in Foxit PDF Editor/Reader
-
ExecutionField processing deletes current page
-
PersistDangling field objects dereferenced (use-after-free)
-
ImpactIllegal memory read crashes application (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted PDF whose document structure causes field processing to re-enter and delete the current page while field objects captured beforehand are still in use (CVSS UI:R confirms mandatory user interaction; AV:L confirms a local file-open vector). Limiting factors: the attack is not remote/automatic - it needs social engineering to get the user to open the file in a vulnerable Foxit PDF Editor (≤14.0.4/13.2.4/2026.1.1) or Reader (≤2026.1.1); it targets the interactive form/field code path, so viewers that block form processing or JavaScript reduce exposure; and per the description the demonstrated outcome is a crash (illegal read), not confirmed reliable code execution. |
| Impact | The published CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) reflects a local, low-complexity, unauthenticated-but-user-interaction-required issue. That C:H/I:H/A:H rating is optimistic relative to the description and the vendor tags: the description explicitly says the outcome is an 'illegal read' and a 'crash', and the tags emphasize Denial Of Service / Memory Corruption, which points to availability impact (and possibly limited memory disclosure) rather than confirmed code execution - verify the full impact with the Foxit bulletin. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation-probability signals are absent. Realistically this is a client-side DoS requiring social engineering (the victim must open a malicious PDF); it is a patch-worthy issue but not an emergency compared with remotely exploitable, actively exploited flaws. The AV:L designation is consistent with the local file-open attack path, though such files are commonly delivered remotely via email or web. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted PDF whose form/field structure triggers deletion of the current page during field processing; when the victim opens it in a vulnerable Foxit PDF Editor or Reader, the application dereferences freed field objects and reads illegal memory, crashing the process (denial of service, with potential for limited memory disclosure or further corruption). No public exploit code was identified at time of analysis, and success depends on the local user interaction (opening the file) reflected in the CVSS UI:R metric. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free during PDF field processing in Foxit PDF Editor and Foxit PDF Reader allows a crafted document to delete the current page and then reuse now-dangling field objects, causing an illegal memory read and application crash. Affects Foxit PDF Editor through 14.0.4 / 2026.1.1 and Foxit PDF Reader through 2026.1.1; exploitation requires a user to open a malicious PDF. No public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor (Foxit) reported it and tags it primarily as denial of service / memory corruption.
RemediationAI
Patch available per vendor advisory: update to the latest fixed release of Foxit PDF Editor and Foxit PDF Reader listed on the Foxit security bulletins page at https://www.foxit.com/support/security-bulletins.html (the input does not specify an exact patched version number, so confirm the fixed build there before deploying). Because the affected versions are all builds 'and earlier', upgrade past the highest listed vulnerable versions (Editor 14.0.4 / 13.2.4 / 2026.1.1 and Reader 2026.1.1). Until patched, compensating controls include disabling or restricting interactive PDF form/JavaScript features in the product's preferences to reduce field-processing exposure (trade-off: breaks legitimate form workflows), enabling Safe Reading/Protected Mode if available, and instructing users not to open PDFs from untrusted sources; organizations can also route PDFs through a server-side sandbox or alternate renderer for untrusted mail attachments (trade-off: added processing latency and possible rendering fidelity differences).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free). During interactive form/field processing the application re-enters the document object structure and deletes the current page object; execution then continues to operate on field objects that were captured before the deletion, so those pointers now reference freed memory. Dereferencing them produces an out-of-bounds/illegal read. The affected components are the desktop PDF engines identified by the CPEs cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader - client-side document parsers/renderers that process untrusted PDF content, a class of software where lifetime-management bugs in form and annotation handling are a recurring source of memory-corruption vulnerabilities.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector needing user to open the PDF (AV:L/UI:R, PR:N); described outcome is an illegal read and crash so A:H with only possible limited memory disclosure (C:L) and no integrity impact.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objects obtained before deletion, triggering an illegal read and crashing.
Executive ViewAI
Foxit PDF Editor and Reader (through versions 14.0.4/2026.1.1 and 2026.1.1 respectively) contain a use-after-free vulnerability that crashes the application when users open malicious PDFs, creating a denial-of-service risk across any organization relying on Foxit for document processing. The flaw requires user interaction but no authentication, making email-based social engineering a viable attack vector for business disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: require user verification of PDF source before opening, run Foxit in isolated sandbox or virtual machine environments, implement mandatory user training on PDF-based social engineering attacks, restrict Foxit to documented business-critical workflows, subscribe to Foxit security advisory feeds, and monitor for email-based threat indicators related to suspicious PDF delivery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB