EUVD-2026-25825Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious XFA PDF
-
DeliveryDelivers file to victim via email or web
-
ExploitVictim opens PDF in Foxit
-
ExecutionXFA calculate event triggers
-
PersistUse-after-free in memory handler
-
ImpactApplication crash or code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerability requires opening a crafted XFA PDF file; it is not remotely exploitable and requires explicit user interaction. XFA form processing must be active and enabled in the Foxit application (default configuration). The calculate event must be triggered during form field interactions, which occurs automatically when the PDF is opened or forms are interacted with. Exploitation is constrained by local access (user must be able to open a file), the need for user interaction, and heap memory layout unpredictability for code execution; successful RCE is not guaranteed and depends on memory state at the time of exploitation. |
| Impact | The CVSS 5.5 score reflects a local attack vector (AV:L) with low complexity (AC:L), no privilege requirement (PR:N), but requiring user interaction (UI:R), with high availability impact (A:H) and no confidentiality or integrity impact. However, the CVE description explicitly states 'arbitrary code execution' despite the CVSS integrity (I) and confidentiality (C) ratings both being None, creating a discrepancy between the stated impact and the vector. This suggests either the CVSS vector underestimates integrity/confidentiality risk or the CVE description conflates crash-based DoS with actual RCE potential. The requirement for user interaction (opening a file) significantly limits attack surface compared to network-based vectors. EPSS score unavailable in provided data. No KEV listing or public exploit confirmed, suggesting limited real-world exploitation pressure. The primary risk is denial of service via application crash; code execution claims warrant independent verification from Foxit's advisory before prioritizing as critical. |
| Exploit ScenarioDerived | A user receives a malicious PDF file via email or downloads it from a compromised website. The PDF contains a crafted XFA form designed to trigger a use-after-free condition when the calculate event processes. When the user opens the file in Foxit PDF Editor or Foxit PDF Reader, the application crashes and, under specific memory conditions, may execute attacker-supplied code with the privileges of the logged-in user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 27, 2026
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application or execute arbitrary code by opening a crafted XFA PDF file during calculate event processing. The vulnerability requires user interaction (opening a malicious PDF) but impacts both products across all versions listed in CPE data. No public exploit code or active exploitation has been confirmed at this time.
RemediationAI
Check Foxit's security bulletins at https://www.foxit.com/support/security-bulletins.html for the CVE-2026-5939 advisory to identify patched versions for both Foxit PDF Editor and Foxit PDF Reader, then upgrade to the recommended fixed version. As an interim compensating control, restrict access to XFA-enabled PDFs from untrusted sources by implementing document scanning policies and user awareness training to avoid opening suspicious PDF attachments. Organizations can also disable XFA form processing in Foxit settings if the feature is not operationally required, though this may limit legitimate form functionality. Monitor Foxit software for unexpected crashes during PDF loading as an early detection signal.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XFA (XML Forms Architecture) is an Adobe technology embedded in PDF documents to enable dynamic form behavior and scripting. The vulnerability is a use-after-free condition (CWE-416), a memory safety flaw where the application attempts to access memory that has already been freed during the calculate event phase of XFA form processing. Calculate events fire when form field values change, triggering recalculation of dependent fields. A specially crafted XFA PDF can manipulate the object lifecycle during this event, causing a freed memory reference to be accessed, leading to undefined behavior ranging from denial of service to code execution depending on heap state and memory layout.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
GitHub PoC
Exploit-DB