Foxit PDF Reader/Editor CVE-2026-5940

Requires user to open a specially crafted PDF file containing malicious JavaScript code in a vulnerable version of Foxit PDF Reader or Editor. JavaScript execution must be enabled in the application (enabled by default in standard configurations). The PDF must contain both removable comment objects and scripting that performs the specific sequence of comment deletion followed by UI refresh function calls. Exploitation delivers local code execution at the privilege level of the user who opened the PDF. Does not work against users who have disabled JavaScript in PDF reader preferences or organizations using PDF sanitization gateways that strip JavaScript before delivery.

Real-world risk is moderate despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with low complexity but mandatory user interaction - attackers must deliver a malicious PDF and convince users to open it, typically via phishing or watering hole attacks. The UI:R requirement prevents automated mass exploitation and significantly reduces SSVC automatable score. No EPSS data provided, but user interaction dependency typically correlates with lower exploitation probability compared to network services. Not present in CISA KEV, indicating no confirmed active exploitation campaigns. The high impact scores (C:H/I:H/A:H) reflect successful exploitation grants full code execution privileges, potentially allowing malware installation or data theft. Primary risk exists for organizations handling untrusted PDFs, especially in email-heavy environments. The vulnerability requires specific JavaScript actions in PDFs, which security-conscious organizations may already block via PDF reader hardening policies that disable JavaScript execution.

An attacker crafts a malicious PDF document containing embedded JavaScript that programmatically deletes comment annotations and immediately triggers a UI refresh operation, causing the application to dereference freed memory. The attacker delivers this PDF via phishing email with a convincing pretext (invoice, resume, contract). When the victim opens the PDF in vulnerable Foxit PDF Reader, the JavaScript executes automatically or upon user interaction with document elements, triggering the use-after-free condition and allowing the attacker to execute arbitrary code in the context of the user's session, potentially installing malware or exfiltrating documents.