Foxit PDF Reader CVE-2026-5941

Victim must open a specially crafted PDF file using vulnerable versions of Foxit PDF Reader or Foxit PDF Editor (UI:R requirement). The malicious PDF must contain malformed form field hierarchies specifically designed to trigger the signature parsing logic flaw. No special application configuration or non-default settings are required-default installations are exploitable. No authentication or elevated privileges needed (PR:N), meaning standard user accounts are sufficient targets. Exploitation is limited to local attack vector (AV:L), requiring the attacker to deliver the malicious PDF to the target system through social engineering, removable media, email, or compromised file shares rather than direct network-based exploitation. The low attack complexity (AC:L) indicates the vulnerability triggers reliably once the malicious PDF is processed, without requiring race conditions or environmental randomness.

Real-world risk assessment reveals moderate-to-high concern with important caveats. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack requiring user interaction but no privileges, with high impact across confidentiality, integrity, and availability. However, the local attack vector significantly constrains exploitation scenarios compared to network-based vulnerabilities. EPSS data is not available in the provided intelligence, preventing quantitative exploitation probability assessment. CISA KEV status is negative, indicating no confirmed active exploitation in federal enterprise or widespread campaigns. The 'Denial Of Service' tag suggests vendor assessment prioritizes availability impact, though the CVSS impact ratings (C:H/I:H/A:H) indicate potential for code execution beyond simple crashes. Attack complexity is low (AC:L), meaning reliable exploitation is feasible once the malicious PDF reaches the target. The requirement for user interaction (UI:R) provides a natural defense layer through security awareness training. Critical gap: No POC availability data provided, and affected version ranges are not specified in CPE strings (marked with wildcard *:*), making precise asset inventory challenging. Organizations should prioritize patching based on exposure to untrusted PDF sources rather than CVSS score alone.

An attacker crafts a malicious PDF file containing intentionally malformed form field hierarchies designed to trigger the signature parsing flaw. The weaponized PDF is delivered via email attachment, drive-by download, or USB drop targeting specific individuals or organizations. When the victim opens the PDF using vulnerable Foxit PDF Reader or Editor, the parsing engine misidentifies non-signature data as valid signature objects, causing invalid memory writes that crash the application or potentially allow arbitrary code execution in the context of the user's privileges.