Foxit PDF Reader CVE-2026-91818

Exploitation requires the victim to open a maliciously crafted PDF in Foxit PDF Editor or Foxit PDF Reader, and the document must contain JavaScript that induces reentrant page-event processing during annotation enumeration (UI:R is mandatory per the CVSS vector). No authentication is required (PR:N) and the vector is local (AV:L) - the attacker cannot trigger this remotely without the user opening the file. Limiting factors: it depends on JavaScript execution being enabled in the reader (a common default but hardenable/disable-able configuration) and on the specific annotation-enumeration code path; deployments that disable PDF JavaScript materially reduce exposure.

This is a CWE-416 use-after-free reachable when a victim opens a crafted PDF that exercises Foxit's JavaScript annotation handling; the vendor CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local attack vector, no privileges, but mandatory user interaction. There is a notable internal conflict in the data: the vendor CVSS asserts full C:H/I:H/A:H (code-execution-grade impact), yet the description itself only states the flaw 'results in an application crash,' and the input Tags foreground 'Denial Of Service.' Use-after-free bugs are frequently escalatable from crash to code execution, so the C:H/I:H rating is plausible-but-not-demonstrated from the text provided - treat the confidentiality/integrity impact as vendor-asserted potential rather than confirmed. On real-world risk signals: no EPSS score, no CISA KEV listing, and no public POC were provided, and the sole reference is Foxit's general security-bulletins landing page (no specific advisory ID or fixed version). Net: this is a legitimate memory-corruption bug in widely deployed software, but it is user-interaction-gated (victim must open a malicious file) and shows no evidence of active exploitation, placing it in the routine-patch tier rather than emergency response.

An attacker emails or hosts a malicious PDF containing JavaScript that triggers reentrant page-event processing during annotation enumeration; when the victim opens it in Foxit PDF Editor/Reader, a page object is freed and then accessed. At minimum this crashes the application (DoS), and per the vendor's C:H/I:H rating the use-after-free may be groomed toward arbitrary code execution in the user's context. No public exploit code was identified at time of analysis.