Foxit PDF Editor and Reader CVE-2026-5938

The vulnerability requires that a user actively open a PDF document containing the malicious action chain in Foxit PDF Editor or PDF Reader; there is no evidence of automatic triggering upon file receipt or background processing. The crafted document must leverage Foxit's specific document action chain implementation to achieve modal dialog re-entry, meaning it is tailored to Foxit's PDF processing engine rather than being universally exploitable across all PDF readers. The vulnerability does not trigger on default configurations without user action, and does not affect closed or sandboxed environments where PDF viewing is disabled. Exploitation is constrained to local user sessions with access to the Foxit application.

The CVSS score of 5.5 reflects moderate risk with a local attack vector and user interaction requirement, but the impact is limited to availability denial rather than confidentiality or integrity compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates that an unauthenticated local user with no special privileges can trigger the vulnerability by convincing a user to open a malicious PDF, with low attack complexity. The high availability impact (A:H) accurately captures the UI freeze condition. However, real-world risk is constrained by the requirement for user interaction (UI:R) - the victim must actively open the malicious document - and the local-only attack vector, limiting exploitation to scenarios where an attacker can deliver a file to a user. The attack does not result in code execution, data theft, or persistent compromise. While denial of service is operationally disruptive, it is less critical than vulnerabilities enabling remote code execution or privilege escalation. This should be prioritized for patching in environments where PDF processing is frequent, but is not an emergency-level vulnerability.

An attacker crafts a malicious PDF document containing an action chain designed to trigger recursive modal dialog re-entry. The attacker distributes this file via email or a web download. A user, unaware of the malicious payload, opens the PDF in Foxit PDF Editor or Reader. Upon opening, the document's action chain executes, causing the modal dialog manager to re-enter while processing dialogs, freezing the UI. The application becomes unresponsive, forcing the user to force-quit the process.