EUVD-2026-85154
GHSA-j3h3-v4jq-6qgp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF with malformed form fields
-
DeliveryDeliver document via email or web
-
ExploitVictim opens file in Foxit
-
ExecutionField-name traversal accesses freed object
-
ImpactApplication crash or memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open an attacker-crafted PDF containing malformed form fields in Foxit PDF Editor or Foxit PDF Reader; exploitation depends on the specific field-name traversal code path that accesses a released object. Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - there is no remote or unauthenticated network trigger - so an attacker must socially engineer the target into opening the malicious document. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data. |
| Impact | This is a client-side memory-corruption flaw (CWE-416 use-after-free) in Foxit PDF Editor/Reader triggered by opening a malicious PDF, not a server-side or remotely-reachable issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a local vector requiring user interaction - the '7.8' is driven by full C:H/I:H/A:H impact, which assumes the use-after-free is exploitable for code execution. However, the description explicitly states the outcome is only 'an application crash,' and the vendor-supplied tags lead with 'Denial Of Service' - a conflict worth flagging: the described impact (crash = availability loss) is narrower than the C:H/I:H claimed in the vector. Use-after-free bugs are frequently escalatable from crash to code execution, so the high-impact rating is defensible in principle, but only a crash is confirmed by the text. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable mass abuse; this is a targeted, victim-must-open-a-file class of bug. Priority is moderate: worth patching in PDF-handling fleets, but it is not a drop-everything remotely-exploitable emergency. Note the single reference is only the generic Foxit security-bulletins landing page, not a specific advisory, so affected/fixed versions are not independently verifiable from this input. |
| Exploit ScenarioDerived | An attacker crafts a PDF with malformed form fields and delivers it via email or a web download; when the victim opens it in Foxit PDF Editor or Reader, improper validation during field-name traversal accesses a freed object, crashing the application and potentially allowing memory corruption to be leveraged further. No public exploit code is identified at time of analysis, and exploitation requires the user to open the malicious document (UI:R, local vector). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Opening a specially crafted PDF with malformed form fields in Foxit PDF Editor or Foxit PDF Reader can trigger a use-after-free (CWE-416) that crashes the application and corrupts memory. The flaw is reachable only through the local, user-interaction vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H per independent assessment), meaning an attacker must first socially engineer a victim into opening a malicious document - there is no remote or unauthenticated network trigger, and no public exploit code was identified at time of analysis. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data, so the practical impact should be treated as availability loss with potential secondary confidentiality/integrity effects rather than a proven full remote code execution chain.
RemediationAI
No vendor-released patch version is identified in the available data; the primary action is to monitor the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html) and apply the patched Foxit PDF Editor/Reader build for your platform as soon as Foxit publishes it, then verify the installed version rather than assuming an auto-update succeeded - note that the CPE data does not yet tie this CVE to a specific fixed version, so do not rely on any unverified version number. Until a patch is confirmed, apply these compensating controls with their trade-offs: enable Foxit's Protected Mode / Safe Reading Mode so that parsing occurs in a restricted sandbox (side effect: some advanced document features and cross-document operations may be blocked or prompt the user); disable JavaScript execution in Preferences so form-field action handlers are not invoked (side effect: interactive forms, calculations, and validation scripts will not function, which may break business workflows); and block or quarantine inbound PDF attachments at the email gateway and web proxy for users who do not require them (side effect: legitimate PDF delivery is disrupted and users may route around controls). Because the vector is AV:L with UI:R, user awareness training to avoid opening unexpected PDF attachments is a meaningful control, and EDR/exploit-protection policies (for example, hardened heap/ASLR and application-level crash telemetry) can help detect exploitation attempts that manifest as crashes during field-name traversal.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Foxit PDF Editor and Foxit PDF Reader's handling of PDF form fields - the AcroForm structures that define interactive field names, hierarchical field trees, and their associated JavaScript actions. During traversal of the field-name hierarchy, the application fails to validate object state properly and continues to dereference a memory object that has already been freed, producing memory corruption that manifests as an application crash and creates conditions that could, in principle, be steered toward code execution. Because the affected code lives in the native PDF parsing/form-processing engine rather than a sandboxed script layer, the flaw is a classic client-side document-parser memory-safety issue. Affected CPE identifiers cover the entire unversioned product ranges for foxit_software_inc.:foxit_pdf_editor and foxit_software_inc.:foxit_pdf_reader, indicating the issue applies across current releases rather than a single build. The relevant vendor reference is the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html).
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open with user interaction (AV:L/UI:R, no auth PR:N); description confirms only a crash so A:H with reduced C:L/I:L reflecting unproven-but-plausible UAF escalation.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and Foxit PDF Reader contain a use-after-free vulnerability that can be triggered when a user opens a specially crafted PDF, leading to application crashes and potential memory corruption. Because no vendor patch is available and exploitation requires only local user interaction, any employee who opens a malicious PDF could disrupt business operations and expose sensitive data. Leadership should prioritize interim mitigations and user awareness to reduce risk while awaiting a fix.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling JavaScript in Foxit, using application sandboxing, opening untrusted PDFs in isolated virtual machines, and enforcing least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB