EUVD-2026-85132
GHSA-2w63-pggx-6fp3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malformed optional-content image object
-
DeliveryDeliver document to victim (email/download)
-
ExploitVictim opens file in Foxit
-
ExecutionRendering accesses freed internal structure (UAF)
-
ImpactCrash or potential arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted PDF in Foxit PDF Editor or Foxit PDF Reader; the file must contain an image object whose optional-content (OCG) attributes are malformed, which is processed during page-image rendering. Limiting factors: mandatory user interaction (UI:R - the target must be socially engineered into opening the document), local delivery of the file (AV:L), and no authentication or special privilege is required on the attacker side (PR:N). As described the reliably reproducible outcome is an application crash; achieving code execution from the use-after-free would require additional heap-grooming and is not demonstrated in the source data. |
| Impact | The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent for a client-side file-parsing memory-corruption bug: local attack vector reflects that the malicious PDF must reach the victim's machine and be opened (UI:R), while PR:N correctly notes no authentication is needed. There is a notable tension between the DESCRIPTION and the IMPACT metrics: the description characterizes the bug as merely 'triggering a crash due to UAF' (availability/DoS), yet the vendor rates full C:H/I:H/A:H. This is defensible because CWE-416 use-after-free of an internal data structure is a classic RCE primitive whose ceiling is code execution - but as written, only the crash (A:H) is demonstrated; the C:H/I:H is a plausible-ceiling assessment, not a confirmed exploit outcome. No EPSS score, no CISA KEV listing, and no public PoC are present in the provided data; exploitation status is therefore 'no public exploit identified at time of analysis.' Net: this is a moderate-priority client-side patch-when-available issue rather than a drop-everything emergency - real-world exploitation requires social-engineering a victim into opening a crafted document, and no active-exploitation or PoC signal elevates it. The high real-world footprint of Foxit is the main reason it warrants timely patching once a fixed build is published. |
| Exploit ScenarioDerived | An attacker crafts a PDF containing an image object with malformed optional-content (OCG) attributes and delivers it via email or a download link. When the victim opens the document in Foxit PDF Editor/Reader, the page-image rendering path accesses an already-freed internal data structure, crashing the application; a skilled attacker could potentially groom the freed allocation to convert the use-after-free into code execution. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects carry malformed optional-content (OCG) attributes, which the program processes while rendering the page image and which causes it to dereference an already-freed internal data structure. The reliably reproducible outcome described by the vendor is an application crash (denial of service); because the defect is a memory-corruption class (CWE-416), code execution in the context of the user may be possible but would require additional heap grooming that is not demonstrated in the available data. Exploitation requires local delivery of the malicious file and a victim to open it (AV:L, UI:R), while no authentication or privileges are needed on the attacker side (PR:N); the vendor-rated CVSS 3.1 base score is 7.8 (High). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
RemediationAI
Apply the current Foxit security update for Foxit PDF Editor and Foxit PDF Reader as published in the vendor's security bulletins page (https://www.foxit.com/support/security-bulletins.html); the available reference does not state an exact patched version, so the specific fixed build must be read from that bulletin, and no vendor-released patch version is identified in the input data. Until an update is deployed, reduce exposure by ensuring the Safe Reading Mode / Protected View style restrictions in Foxit remain enabled (this limits what a crafted document can do but can break legitimate interactive documents that rely on scripts, embedded files or privileged actions), by routing PDFs through an email/web gateway that sanitizes or blocks untrusted documents before delivery (content filtering has false-positive costs and can be bypassed by encrypted archives), by opening untrusted PDFs only in an isolated environment or a low-privilege account with OS-level exploit mitigations (ASLR/DEP, sandboxing) enabled, and by monitoring EDR telemetry for Foxit process crash events or abnormal child-process creation originating from a PDF viewer, which is the observable signal for a UAF attempt. Because exploitation requires the victim to open the file (UI:R), user awareness of unsolicited PDF attachments remains a meaningful complementary control, though it is not a substitute for patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in the PDF rendering pipeline of Foxit PDF Editor and Foxit PDF Reader. PDF documents may associate optional content - Optional Content Groups (OCGs) declared in the document's OCProperties dictionary - with content streams and image XObjects so that layers can be toggled or filtered at render time. Foxit's rendering engine resolves these optional-content attributes while composing page images; when the attributes on an image object are malformed, the engine's validation is insufficient and it operates on a pointer to an internal structure that has already been released, producing a dangling reference and, in the described case, an application crash. Because the freed object is reused through an attacker-influenced parsing path, the bug class is memory corruption rather than a simple null-dereference, which is why the vendor scored confidentiality, integrity and availability impacts as High (7.8). The CPE data (cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*) confirms both the Editor and Reader product lines are in scope, and the CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U) is consistent with a client-side file-parsing flaw that must be delivered to the victim's machine and opened by the user, with exploitation independent of OS-level memory mitigations that typically reduce a UAF to a crash absent a working heap-spray.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse UAF opened by a victim (AV:L/UI:R/PR:N); UAF of an internal structure supports the full C:H/I:H/A:H ceiling, matching the vendor vector.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and Foxit PDF Reader, which are widely deployed productivity applications on knowledge-worker endpoints, contain a memory-corruption flaw (CWE-416 use-after-free) that a victim triggers simply by opening a maliciously crafted PDF. No vendor patch is currently available, and while the only reliably demonstrated outcome is an application crash, the underlying defect class could allow an attacker to run code with the victim user's privileges. Leadership should care because the exposure is broad across any business unit that standardizes on Foxit, the attack requires no credentials, and the primary defense available today is user behavior and endpoint hardening rather than a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict opening of PDFs from untrusted or external sources through email and web gateway filtering, user awareness notices advising caution with unsolicited PDF attachments, endpoint hardening with exploit-protection and heap/ASLR mitigations on Foxit binaries, EDR monitoring for Foxit crashes and unusual child-process activity, running Foxit under least-privilege non-administrative accounts, and evaluating a hardened or sandboxed alternative PDF reader for high-risk users until the vendor issues a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading t
Exploit-DB