What is the CVSS score of CVE-2026-5938?

CVE-2026-5938 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Foxit PDF Editor and Reader CVE-2026-5938

EUVD-2026-25824 MEDIUM

Insufficient Control Flow Management (CWE-691)

2026-04-27 Foxit

Denial Of Service Foxit Pdf Editor Foxit Pdf Reader

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 27, 2026 - 12:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25824

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:00 nvd

MEDIUM 5.5

DescriptionCVE.org

Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.

AnalysisAI

Modal dialog reentry vulnerability in Foxit PDF Editor and Reader allows local attackers to trigger UI freeze and denial of service by supplying a crafted PDF document with a malicious action chain, requiring user interaction to open the file. The vulnerability stems from improper control flow management in document action handling and results in application unresponsiveness on the main thread. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the document action chain processing mechanism within Foxit PDF Editor and Reader. PDF documents support action chains that define sequences of operations triggered by user interaction or document events; these actions are processed on the application's main UI thread. The root cause is classified as CWE-691 (Improper Control Flow Management), indicating that the application fails to properly guard against recursive or re-entrant calls to modal dialog display functions. When a specially crafted action chain causes a modal dialog to be re-entered while already active, the event loop becomes blocked, causing the UI to freeze. This is a common vulnerability class in applications that use synchronous modal dialogs without adequate re-entrancy guards.

RemediationAI

Contact Foxit Software for a patched version of Foxit PDF Editor or PDF Reader. Foxit's security bulletins are available at https://www.foxit.com/support/security-bulletins.html and should be consulted for the specific fixed version and availability timeline. As a compensating control prior to patching, restrict the opening of PDF documents from untrusted sources and disable document action execution if your PDF viewer supports that setting (this may limit PDF functionality). Additionally, disable auto-open features for PDFs received via email or downloaded from the internet. Users should update as soon as patched versions are released by Foxit; the vendor's bulletin should be monitored for release announcements.