What is the CVSS score of CVE-2026-5937?

CVE-2026-5937 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Foxit PDF Editor and Reader CVE-2026-5937

EUVD-2026-25823 MEDIUM

Uncaught Exception (CWE-248)

2026-04-27 Foxit

Information Disclosure Foxit Pdf Editor Foxit Pdf Reader

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 27, 2026 - 12:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25823

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:00 nvd

MEDIUM 5.5

DescriptionCVE.org

Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.

AnalysisAI

Unhandled exception in Foxit PDF Editor and Foxit PDF Reader allows local denial of service when a user opens a maliciously crafted PDF file with insufficient parameter verification, causing the application to crash via an uncaught std::invalid_argument exception. The vulnerability requires user interaction (opening a file) and local file access but affects all versions of both products without authentication requirements.

Technical ContextAI

The vulnerability stems from CWE-248 (Uncaught Exception), a class of weaknesses where applications fail to properly catch and handle exceptions. In this case, Foxit's PDF parsing engine does not validate parameters sufficiently before processing file data, leading to format errors that trigger an unhandled C++ std::invalid_argument exception. This exception occurs at a level in the call stack where no exception handler exists, causing immediate application termination. The affected products (Foxit PDF Editor and Foxit PDF Reader) share common PDF parsing libraries where this validation gap exists across multiple versions.

RemediationAI

Contact Foxit Software for patch availability and specific fix versions, as the security bulletin reference does not provide explicit patch versions in the available data. Users should avoid opening PDF files from untrusted sources until a patch is available. As a temporary compensating control, disable PDF auto-opening in email clients and file managers, and restrict PDF file access to sandboxed or isolated environments if available. Users can work around individual problematic PDFs by using alternative PDF readers (such as Adobe Acrobat Reader or open-source tools) to determine if the file is malicious before attempting to open it in Foxit. Monitor Foxit's support page for security bulletin updates that will contain precise fix versions and deployment guidance.