What is the CVSS score of EUVD-2026-42185?

EUVD-2026-42185 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by EUVD-2026-42185?

Foxit PDF Reader and Editor (versions 2026.1.1 and earlier) are vulnerable to denial-of-service attacks triggered by malicious PDF documents, causing application crashes and work interruptions.

How to fix or mitigate EUVD-2026-42185?

Within 24 hours: Disable JavaScript execution in Foxit PDF Reader and Editor via group policy; brief users to avoid untrusted PDFs; monitor support tickets for unexplained crashes. Within 7 days: Audit all Foxit instances for versions ≤2026.1.1; implement endpoint controls restricting Foxit launch from Downloads and email attachments; review Foxit vendor security advisories. Within 30 days: Monitor Foxit vendor advisories for patch release; prepare deployment package for immediate rollout; evaluate alternative PDF readers if remediation timeline extends.

Foxit PDF Reader EUVD-2026-42185

| CVE-2026-13128 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-v4qp-8g92-cj69

Memory Corruption Denial Of Service Use After Free Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Local malicious-file vector requiring the user to open the PDF (AV:L, UI:R); described impact is only an application crash, so A:H with C:N/I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:18 vuln.today

DescriptionCVE.org

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

AnalysisAI

Denial-of-service in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1 and earlier) occurs when a victim opens a crafted PDF whose embedded JavaScript deletes the current page, after which subsequent scripts dereference now-freed document-view properties and crash the application. This is a CWE-416 use-after-free reported by Foxit; no public exploit identified at time of analysis, and it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deliver crafted PDF to victim

Delivery

User opens file in Foxit

Exploit

Embedded JavaScript deletes page

Execution

Later script accesses freed view properties

Impact

Use-after-free triggers application crash

Access

Deliver crafted PDF to victim

Delivery

User opens file in Foxit

Exploit

Embedded JavaScript deletes page

Execution

Later script accesses freed view properties

Impact

Use-after-free triggers application crash

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open a specially crafted PDF in Foxit PDF Reader or PDF Editor (version 2026.1.1 or earlier) with JavaScript execution enabled (Foxit's default), where the embedded script must first delete a page and then have subsequent scripts access the freed document-view properties. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker emails or hosts a booby-trapped PDF and lures a user of Foxit PDF Reader/Editor 2026.1.1 or earlier into opening it; the document's embedded JavaScript deletes a page and then references the freed document-view properties, crashing the application (a use-after-free). No public POC was provided, and because the vector is local with required user interaction, exploitation depends entirely on convincing the victim to open the file.
Remediation	Update to a Foxit-released version newer than 2026.1.1 for both PDF Reader and PDF Editor; the exact fixed build should be confirmed against Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html, as no specific fixed version was provided in this data (Patch available per vendor advisory; exact fix version not independently confirmed). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Disable JavaScript execution in Foxit PDF Reader and Editor via group policy; brief users to avoid untrusted PDFs; monitor support tickets for unexplained crashes. …

Threat intelligence, references, and detailed analysis are available after sign-in.