Foxit PDF Reader CVE-2026-91816

Exploitation requires the victim to open a crafted PDF (UI:R) in Foxit PDF Editor or Reader, and that PDF must contain embedded JavaScript that triggers reentrant deletion of an annotation object - meaning JavaScript execution must be enabled/permitted in the reader. The attack vector is local (AV:L): the attacker cannot reach the application remotely and must rely on file delivery and user interaction. Limiting factors: mandatory user action to open the document, dependence on the embedded-JavaScript annotation-handling code path, and no authentication or special privileges otherwise required (PR:N).

This is a client-side, file-format use-after-free requiring the victim to open a malicious PDF, which the CVSS vector accurately captures: AV:L (the attacker cannot reach the target over a network - the malicious file must be delivered and opened locally), AC:L, PR:N (no authentication to the app), and critically UI:R (user must open the crafted document). The vendor's C:H/I:H/A:H impact and CWE-416 are consistent with a memory-corruption primitive that can plausibly be escalated beyond the stated crash to code execution, though the description itself only confirms a use-after-free and 'application crash' - the DoS outcome is confirmed while full RCE is an inferred worst case. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automatable mass attack; this is a targeted, social-engineering-dependent issue rather than a wormable network flaw. Net: a legitimately high base score (7.8) but real-world urgency is moderated by the UI:R requirement and the absence of any exploitation signal. Note the conflict between the 'Denial Of Service' tag / crash-only description and the C:H/I:H full-impact vector - verify with Foxit whether code execution is achievable.

An attacker crafts a PDF containing embedded JavaScript that triggers reentrant deletion of an annotation object, then references the freed object to create a use-after-free. The victim opens the file in Foxit PDF Reader or Editor, causing at minimum an application crash and potentially attacker-controlled memory access. No public exploit code was identified at time of analysis, and successful exploitation depends on the user opening the malicious document.