What is the CVSS score of CVE-2026-5943?

CVE-2026-5943 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Foxit PDF Reader are affected by CVE-2026-5943?

CVE-2026-5943 is a use-after-free vulnerability in Foxit PDF Reader and Foxit PDF Editor that allows local attackers to execute arbitrary code or crash the application through malicious PDF…

How to fix or mitigate CVE-2026-5943?

Within 24 hours: Identify and inventory all Foxit PDF Reader and Foxit PDF Editor deployments across the organization; notify users to avoid opening PDF files from untrusted sources. Within 7 days: Implement application whitelisting to restrict execution of Foxit processes, or disable Foxit scripting features via configuration if available; evaluate alternative PDF readers without this vulnerability. Within 30 days: Monitor Foxit vendor advisories for patch release; plan migration to patched versions immediately upon availability or transition to alternative PDF software with equivalent security posture.

Foxit PDF Reader CVE-2026-5943

EUVD-2026-25829 HIGH

Use After Free (CWE-416)

2026-04-27 Foxit

Memory Corruption Use After Free Denial Of Service Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 27, 2026 - 12:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 27, 2026 - 12:22 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 12:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25829

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:00 nvd

HIGH 7.8

DescriptionCVE.org

Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.

AnalysisAI

Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.

Technical ContextAI

This vulnerability stems from CWE-416 (Use After Free), a memory corruption class where freed heap memory is accessed after deallocation. Foxit PDF products use scripting engines (likely JavaScript) to enable interactive PDF features. When scripts trigger document modifications affecting page structures, the software's internal index and object reference management fails to invalidate pointers to freed memory regions. The CPE data identifies both Foxit PDF Editor (cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor) and Foxit PDF Reader (cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader) as affected, indicating the shared PDF rendering/scripting engine contains the flaw. During page information queries following structure modifications, dereferencing the stale pointer triggers memory corruption, enabling control-flow hijacking or denial of service depending on exploitation technique and heap layout.

RemediationAI

Consult Foxit's official security bulletin at https://www.foxit.com/support/security-bulletins.html for patched versions and apply vendor-released updates immediately. Exact fix versions not independently confirmed from provided data - verify current installed version against vendor advisory and upgrade if listed as vulnerable. As compensating controls until patching: disable JavaScript execution in Foxit PDF products via Edit > Preferences > JavaScript > Enable JavaScript (uncheck) to prevent script-triggered memory corruption, though this breaks interactive PDF features including forms and dynamic content. Implement application whitelisting to block execution of unsigned PDFs from untrusted sources. Deploy PDF sanitization gateways to strip embedded scripts from inbound documents. Train users to avoid opening PDFs from unknown senders or untrusted websites. Note that disabling JavaScript eliminates the trigger mechanism but may impact legitimate business workflows requiring PDF forms or annotations.