EUVD-2026-42193
GHSA-2mpx-xxgw-cq6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF to victim
-
DeliveryVictim opens file in Foxit
-
ExploitJavaScript resets form fields
-
ExecutionNative object freed and re-entered
-
PersistMethod call on dangling object
-
ImpactMemory corruption crashes application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted PDF in Foxit PDF Editor or Foxit PDF Reader, and requires that JavaScript execution is enabled in the client (the default) so the embedded script can call the form-field reset routine that frees the native object. Limiting factors: the vector is local (AV:L) and mandates user interaction (UI:R) - the attack cannot fire without the user actively opening the attacker's document - and no authentication or elevated privileges are needed (PR:N). Disabling JavaScript in the application removes the trigger entirely, and the flaw only affects Foxit's PDF clients, not the underlying OS or unrelated applications. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a local attack vector requiring user interaction - the victim must open a malicious PDF - with no privileges needed and high impact to confidentiality, integrity, and availability. There is a notable tension in the source data: the description only demonstrates an application crash (a denial-of-service outcome, reinforced by the 'Denial Of Service' tag), yet the CVSS assigns C:H/I:H/A:H, which implies code-execution-grade impact. This gap should be verified with Foxit - the high C/I ratings likely reflect the theoretical exploitability of a use-after-free rather than a proven RCE. No EPSS score, KEV listing, POC, or SSVC data was provided, so real-world exploitation pressure cannot be quantified from the input. Overall this is a client-side, interaction-dependent flaw: meaningful but not remotely wormable, and priority should be driven by how widely the affected Foxit clients are deployed and how likely users are to open untrusted PDFs. |
| Exploit ScenarioDerived | An attacker emails or hosts a booby-trapped PDF containing JavaScript that calls a form-reset routine; when the victim opens it in Foxit PDF Editor or Reader, the script frees and then re-uses a native object, corrupting memory and crashing the application. Because this is a use-after-free, a skilled attacker could attempt to groom the heap to control the freed allocation and escalate the crash toward code execution. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader is triggered when JavaScript embedded in a malicious PDF resets form fields and re-enters the interface, causing the application to invoke a method on a freed native object. An attacker who convinces a user to open a crafted PDF can crash the application, and because the flaw is a use-after-free (CWE-416), it carries potential for memory-corruption abuse beyond denial of service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed build listed on Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html (the input data does not include an exact fixed version number, so confirm the target build against that advisory before deployment). As a compensating control until patched, disable JavaScript execution in the affected clients (Preferences > JavaScript > uncheck 'Enable JavaScript Actions'), which directly removes the reset-form script path that triggers the use-after-free - the trade-off is that legitimate interactive/JavaScript-enabled forms will stop functioning. Additionally, restrict opening of PDFs from untrusted sources and consider rendering untrusted PDFs in a sandboxed or browser-based viewer, accepting reduced fidelity for advanced Foxit features.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the JavaScript-driven form-handling engine of Foxit's PDF applications, which expose a scripting interface (resetForm and related field-manipulation APIs) that operate on underlying native C/C++ objects. When the reset routine executes, it re-enters the interface and destroys/frees the backing native object, but the application fails to validate the object's lifetime before a subsequent function call dereferences it - the classic CWE-416 use-after-free pattern. Affected CPEs are cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader, both desktop PDF clients that parse untrusted documents and embedded JavaScript. Use-after-free in a document parser is significant because the freed memory can potentially be reclaimed and controlled, turning a crash primitive into an exploitable condition.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector (AV:L) needing the user to open a PDF (UI:R) with no privileges (PR:N); use-after-free supports high impact, though the described outcome is a crash.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is damaged, but the application does not perform validation. The function call on the damaged object leads to the application crashing.
Executive ViewAI
Foxit PDF Reader and Editor are vulnerable to a memory corruption attack delivered through malicious PDF files, with no patch currently available. If exploited, this could expose user devices to data theft or system compromise, affecting any organization that processes PDFs from external sources.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable JavaScript in Foxit through application settings, (2) Restrict Foxit to read-only workflows for external documents, (3) Deploy endpoint detection/response (EDR) to alert on abnormal Foxit process behavior or crashes, (4) Require untrusted PDF review on isolated, non-business-critical workstations, (5) Security awareness training emphasizing PDF attachment risks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB