What is the CVSS score of CVE-2026-5940?

CVE-2026-5940 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Foxit PDF Reader/Editor are affected by CVE-2026-5940?

Foxit PDF Reader and Foxit PDF Editor contain a use-after-free vulnerability (CVE-2026-5940) that allows attackers to execute arbitrary code when users open specially crafted PDF documents.

How to fix or mitigate CVE-2026-5940?

Within 24 hours: Inventory all Foxit PDF Reader and Foxit PDF Editor installations across the organization and restrict external PDF handling to sandboxed environments where possible. Within 7 days: Implement application whitelisting or disable PDF scripting features in Foxit products via group policy or product configuration; contact Foxit for patch timeline and interim mitigation recommendations. Within 30 days: Evaluate alternative PDF readers (e.g., Adobe Acrobat DC, Sumatra PDF) or upgrade to patched Foxit versions once vendor releases a fixed build; conduct security awareness training emphasizing caution when opening PDFs from untrusted sources.

Foxit PDF Reader/Editor CVE-2026-5940

EUVD-2026-25826 HIGH

Use After Free (CWE-416)

2026-04-27 Foxit

Memory Corruption Use After Free Denial Of Service Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 27, 2026 - 12:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 27, 2026 - 12:22 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 12:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25826

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:00 nvd

HIGH 7.8

DescriptionCVE.org

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

AnalysisAI

Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

This is a use-after-free vulnerability (CWE-416) in Foxit's PDF rendering engine, affecting both the commercial PDF Editor and free PDF Reader products. The flaw occurs in the JavaScript scripting engine's interaction with the UI rendering subsystem. When embedded JavaScript code programmatically removes comments from a PDF document and subsequently triggers a UI refresh operation, the application accesses memory that has already been deallocated. Use-after-free conditions are particularly dangerous in document readers because they allow attackers to control freed memory contents through carefully structured PDF objects, enabling arbitrary code execution. The vulnerability exists in the object lifecycle management between the scripting API and the UI rendering pipeline, where the comment deletion invalidates pointers that are later dereferenced during screen updates.

RemediationAI

Apply vendor-released patches available through Foxit's security bulletin portal at https://www.foxit.com/support/security-bulletins.html. Specific patched versions not enumerated in available data - refer to the bulletin for exact fixed versions for PDF Reader and PDF Editor respectively. As an interim compensating control, disable JavaScript execution in Foxit PDF products via Edit > Preferences > JavaScript > Enable JavaScript Actions (uncheck), which prevents the scripting trigger required for exploitation but breaks PDF forms and interactive features that rely on JavaScript. For enterprise deployments, implement application whitelisting to block execution of processes spawned from PDF reader processes, limiting post-exploitation impact. Email gateway scanning should flag PDFs containing JavaScript and subject them to enhanced scrutiny or quarantine pending user approval.