Foxit PDF Editor CVE-2026-91806

Exploitation requires the victim to open an attacker-crafted PDF in Foxit PDF Editor or Reader that contains embedded JavaScript specifically written to reference PDF form fields after they have been released (the use-after-free trigger). Key limiting factors: user interaction is mandatory (UI:R) - the file must be opened; the document must contain active JavaScript, so environments that disable PDF JavaScript execution are protected; and the attack vector is local (AV:L), meaning delivery depends on getting the file to the user rather than remote network exploitation. No authentication is required (PR:N) and no special server configuration is involved - this is a client-side document-parsing flaw against default installations.

The CVSS 3.1 base score of 7.8 is driven by a local attack vector (AV:L), low complexity (AC:L), no privileges (PR:N), but required user interaction (UI:R) - the classic profile of a malicious-document attack where the victim must open a crafted PDF. There is a notable internal conflict in the source data: the description characterizes the outcome only as 'an application crash' (a denial-of-service outcome, echoed by the 'Denial Of Service' tag), yet the CVSS vector asserts full C:H/I:H/A:H impact. Use-after-free (CWE-416) memory corruption can in principle be leveraged for code execution, which likely explains the vendor's high confidentiality/integrity scoring, but the only impact the description confirms is a crash - treat the C:H/I:H claim as vendor-assigned worst-case potential, not demonstrated RCE. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation. Net: this is a legitimate client-side memory-corruption bug in a widely used PDF reader worth patching, but absent a POC or KEV entry it is a routine-priority fix rather than an emergency; the real-world impact ceiling (crash vs. full code execution) should be verified against the Foxit security bulletin.

An attacker crafts a PDF containing embedded JavaScript that manipulates form-field objects so that a reference is used after the underlying field has been freed, then delivers it via email, web download, or a shared drive. When the victim opens the document in a vulnerable Foxit PDF Editor/Reader, the use-after-free triggers, crashing the application and potentially corrupting memory in an exploitable way. No public exploit code is identified in the provided data, and successful exploitation requires the user to open the malicious file (UI:R).