EUVD-2026-42183
GHSA-mvfx-5v77-ghpf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with field-deleting JavaScript
-
DeliveryDeliver document via phishing or web
-
ExploitUser opens file in Foxit
-
ExecutionScript frees form fields
-
PersistStale pointers dereferenced (use-after-free)
-
ImpactMemory corruption and application crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor, and that PDF must contain JavaScript that deletes form (AcroForm) fields so the application's subsequent logic dereferences the stale field pointers - JavaScript execution must therefore be enabled (the default). Limiting factors: the CVSS vector is Local (AV:L) with User Interaction Required (UI:R), so there is no remote or unauthenticated auto-trigger - the attack cannot fire without a user deliberately opening the attacker's document, and disabling JavaScript in Foxit removes the trigger entirely. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.8 (High). The Local attack vector plus UI:R (Required) means this is not a remotely-triggered, wormable flaw - a user must open a malicious PDF - which materially lowers real-world urgency versus a network-exploitable RCE, though phishing-delivered documents make UI:R a routine condition to meet. Notably the description states the outcome is an application crash (denial of service), which conflicts with the high Confidentiality and Integrity impacts (C:H/I:H) in the vendor vector; use-after-free bugs frequently are RCE-capable, so the C:H/I:H likely reflects code-execution potential rather than the demonstrated crash - verify exploitability with the vendor. No EPSS score was supplied, the issue is not in CISA KEV, and no POC is referenced, so signals point to a real but not actively-exploited, user-interaction-gated memory-corruption bug rather than a mass-exploitation priority. |
| Exploit ScenarioDerived | An attacker emails or hosts a PDF embedding JavaScript that creates and then deletes form fields; when a victim opens it in a vulnerable Foxit PDF Reader or Editor, the engine reuses freed field pointers, corrupting memory and crashing the application (with potential for further code execution given the vendor's C:H/I:H rating). No public exploit code is identified at time of analysis, and the Local vector with required user interaction means delivery relies on social engineering to get the file opened. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor lets a crafted PDF containing JavaScript trigger stale field-pointer dereferences after the script deletes form fields, corrupting memory and crashing the application. The flaw affects Foxit PDF Editor 14.0.4 and earlier and Foxit PDF Reader 2026.1.1 and earlier and requires the victim to open a malicious file. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Foxit's own CVSS of 7.8 (C:H/I:H/A:H) implies potential code execution beyond the crash described.
RemediationAI
Patch available per vendor advisory - Foxit reported this issue and publishes fixes on its security bulletins page at https://www.foxit.com/support/security-bulletins.html; upgrade Foxit PDF Editor beyond 14.0.4 (and beyond the 13.2.4 and 2026.1.1 branches) and Foxit PDF Reader beyond 2026.1.1 to the versions Foxit lists as fixed, as no exact patched version number was provided in this input and should be confirmed against the bulletin. As a compensating control until patching, disable JavaScript execution in Foxit (Preferences > JavaScript > uncheck 'Enable JavaScript Actions'), which removes the trigger path for this field-deletion bug at the cost of breaking legitimate form scripts and dynamic form behavior; additionally, restrict opening of untrusted PDFs and enable Foxit's Safe Reading Mode / protected view to reduce exposure to malicious documents.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-416 use-after-free in the AcroForm/JavaScript engine shared by Foxit's PDF products. PDF documents can embed JavaScript that manipulates interactive form fields at runtime; when the script deletes field objects, the application frees the underlying field objects but retains and reuses the now-dangling field pointers in subsequent processing logic. Dereferencing these freed pointers reads or writes reclaimed heap memory, producing memory corruption. Per the CPE data, the affected code is in cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader, indicating the shared rendering/scripting core rather than an OS component.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open with required user interaction (AV:L/UI:R); no auth needed (PR:N); use-after-free plausibly enables code execution so C/I/A:H retained, though described impact is only a crash.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid pointer references and causing the application to crash.
Executive ViewAI
A memory corruption vulnerability in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (14.0.4 and earlier) allows arbitrary code execution when users open malicious PDF files containing JavaScript. With no vendor patch currently available and these tools widely deployed across most organizations, this creates elevated risk for any employee handling PDF documents from external sources-particularly email attachments where exploitation is trivial. Immediate compensating controls are required while the patch timeline is clarified with Foxit.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict JavaScript execution in all Foxit Reader/Editor instances; (2) Route all external PDFs through isolated sandboxed environments before opening in Foxit; (3) Implement email content filtering to block or flag PDFs from non-whitelisted external domains; (4) Deploy endpoint detection and response (EDR) solutions configured to detect use-after-free memory corruption exploit signatures; (5) Restrict file-opening permissions via application control policies; (6) Monitor Foxit advisory channels (foxit.com/support) for emergency patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB