Foxit PDF Reader CVE-2026-5943

Requires user to open a specially crafted PDF document containing embedded JavaScript in vulnerable Foxit PDF Reader or PDF Editor version. JavaScript execution must be enabled in application preferences (default configuration). The malicious script must trigger specific document modification operations affecting page element relationships (insertPages, deletePages, or similar API calls) followed by page information queries that reference freed memory. Exploitation is limited to local attack surface requiring social engineering or watering hole delivery to place malicious PDF on victim system. No special system privileges required (PR:N), but mandatory user interaction (UI:R) to open the file creates detection opportunity at email gateway or endpoint protection layers.

Real-world risk is MODERATE despite high CVSS 7.8 score. The CVSS vector reveals critical constraints: AV:L (local vector requiring file delivery), PR:N (no system privileges needed), UI:R (mandatory user interaction to open malicious PDF). Attack complexity is low (AC:L) once the victim opens the file, and scope is unchanged (S:U) limiting impact to the PDF application context. No EPSS, KEV status, or SSVC data provided in input - absence of KEV listing suggests no confirmed active exploitation campaigns at analysis time. No public POC identified, reducing immediate risk. However, use-after-free vulnerabilities are reliably exploitable by skilled attackers given sufficient time for heap manipulation techniques, making this a realistic threat in targeted attacks via phishing or watering hole campaigns distributing weaponized PDFs. Priority depends on deployment context: high-risk for organizations handling untrusted PDFs from external sources, lower for environments with strict email/download filtering and user awareness training. The local attack vector significantly reduces risk compared to network-exploitable vulnerabilities but does not eliminate threat from social engineering delivery.

Attacker crafts a malicious PDF embedding JavaScript that manipulates document structure through page insertion, deletion, or reordering operations. Victim receives PDF via phishing email or downloads from compromised website, then opens it with vulnerable Foxit PDF Reader. The embedded script executes automatically or upon user interaction (e.g., clicking form field), triggering page structure modifications that free memory objects while retaining stale references. When the application queries page information, it dereferences the freed pointer, causing controlled memory corruption. Attacker achieves arbitrary code execution in the context of the user's session, enabling data exfiltration, malware installation, or lateral movement within the network.