What is the CVSS score of CVE-2026-5939?

CVE-2026-5939 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Foxit PDF Editor and Reader CVE-2026-5939

EUVD-2026-25825 MEDIUM

Use After Free (CWE-416)

2026-04-27 Foxit

Memory Corruption Use After Free RCE Foxit Pdf Editor Foxit Pdf Reader

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 27, 2026 - 12:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25825

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application or execute arbitrary code by opening a crafted XFA PDF file during calculate event processing. The vulnerability requires user interaction (opening a malicious PDF) but impacts both products across all versions listed in CPE data. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

XFA (XML Forms Architecture) is an Adobe technology embedded in PDF documents to enable dynamic form behavior and scripting. The vulnerability is a use-after-free condition (CWE-416), a memory safety flaw where the application attempts to access memory that has already been freed during the calculate event phase of XFA form processing. Calculate events fire when form field values change, triggering recalculation of dependent fields. A specially crafted XFA PDF can manipulate the object lifecycle during this event, causing a freed memory reference to be accessed, leading to undefined behavior ranging from denial of service to code execution depending on heap state and memory layout.

RemediationAI

Check Foxit's security bulletins at https://www.foxit.com/support/security-bulletins.html for the CVE-2026-5939 advisory to identify patched versions for both Foxit PDF Editor and Foxit PDF Reader, then upgrade to the recommended fixed version. As an interim compensating control, restrict access to XFA-enabled PDFs from untrusted sources by implementing document scanning policies and user awareness training to avoid opening suspicious PDF attachments. Organizations can also disable XFA form processing in Foxit settings if the feature is not operationally required, though this may limit legitimate form functionality. Monitor Foxit software for unexpected crashes during PDF loading as an early detection signal.