EUVD-2026-85156
GHSA-jwhq-jhrg-mx43
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malicious annotation JavaScript
-
DeliveryDeliver file to victim (email/web)
-
ExploitVictim opens PDF in Foxit
-
ExecutionReentrant page-event frees page object
-
PersistFreed object accessed (use-after-free)
-
ImpactApplication crash or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted PDF in Foxit PDF Editor or Foxit PDF Reader, and the document must contain JavaScript that induces reentrant page-event processing during annotation enumeration (UI:R is mandatory per the CVSS vector). No authentication is required (PR:N) and the vector is local (AV:L) - the attacker cannot trigger this remotely without the user opening the file. Limiting factors: it depends on JavaScript execution being enabled in the reader (a common default but hardenable/disable-able configuration) and on the specific annotation-enumeration code path; deployments that disable PDF JavaScript materially reduce exposure. |
| Impact | This is a CWE-416 use-after-free reachable when a victim opens a crafted PDF that exercises Foxit's JavaScript annotation handling; the vendor CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local attack vector, no privileges, but mandatory user interaction. There is a notable internal conflict in the data: the vendor CVSS asserts full C:H/I:H/A:H (code-execution-grade impact), yet the description itself only states the flaw 'results in an application crash,' and the input Tags foreground 'Denial Of Service.' Use-after-free bugs are frequently escalatable from crash to code execution, so the C:H/I:H rating is plausible-but-not-demonstrated from the text provided - treat the confidentiality/integrity impact as vendor-asserted potential rather than confirmed. On real-world risk signals: no EPSS score, no CISA KEV listing, and no public POC were provided, and the sole reference is Foxit's general security-bulletins landing page (no specific advisory ID or fixed version). Net: this is a legitimate memory-corruption bug in widely deployed software, but it is user-interaction-gated (victim must open a malicious file) and shows no evidence of active exploitation, placing it in the routine-patch tier rather than emergency response. |
| Exploit ScenarioDerived | An attacker emails or hosts a malicious PDF containing JavaScript that triggers reentrant page-event processing during annotation enumeration; when the victim opens it in Foxit PDF Editor/Reader, a page object is freed and then accessed. At minimum this crashes the application (DoS), and per the vendor's C:H/I:H rating the use-after-free may be groomed toward arbitrary code execution in the user's context. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Opening a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor can crash the application through a use-after-free of an internal page object, because JavaScript that triggers reentrant page-event processing during annotation enumeration can free the page while a reference to it is still held. The vendor-approved CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is local, requires no authentication, and mandates user interaction - the victim must open the file - while our independent assessment scores the demonstrated impact as availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), i.e. a denial-of-service/crash rather than demonstrated code execution. Exposure depends on PDF JavaScript being enabled in the reader, a common default but a configurable setting; no public exploit code has been identified and the issue has not been added to CISA KEV, so this is not confirmed active exploitation.
RemediationAI
Patch status is not confirmed by the supplied data - the only reference is the Foxit security bulletin index at https://www.foxit.com/support/security-bulletins.html, so administrators should check that page for the advisory and the exact fixed build number for Foxit PDF Editor and Foxit PDF Reader before assuming any given version is patched; do not rely on the wildcard CPE data to infer a fix. Until a fixed build is verified, disable PDF JavaScript in Foxit (File > Preferences > JavaScript, uncheck 'Enable JavaScript actions', or enforce it centrally via the application's registry/preference templates), which directly removes the trigger for the reentrant page-event path at the cost of breaking JavaScript-dependent PDFs such as calculation-heavy forms and dynamic documents. Enable Protected Mode/Safe Reading restrictions and treat all untrusted PDFs as suspicious, since the vector requires the victim to open the crafted file (UI:R) and cannot be triggered remotely without that interaction; blocking untrusted PDFs at the mail gateway or sandboxing the viewer adds defense in depth but degrades document workflow. Because the independently assessed impact is availability-only, prioritize this as a stability/DoS risk rather than an emergency remote-code-execution emergency, while still tracking vendor guidance for a patched release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in the JavaScript engine that Foxit PDF Editor and Foxit PDF Reader embed for PDF scripting. During annotation enumeration, a JavaScript callback can re-enter page-event processing; that reentrant path may release the page object associated with the annotation being processed, leaving a dangling pointer that is dereferenced immediately afterwards. This is a classic reentrancy-induced lifetime bug: the code assumes the page outlives the enumeration loop, but script execution breaks that assumption. CPE data identifies both cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader as affected with wildcard version fields, meaning the data provided does not bound affected or fixed versions and the vendor bulletin must be consulted for exact ranges. Note the scoring discrepancy: Foxit's vector claims high confidentiality and integrity impact, whereas the independent assessment credits only high availability impact, consistent with the described outcome of an application crash; memory-corruption impact beyond a crash is theoretical in the available evidence.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file-open with required user interaction (AV:L/UI:R/PR:N); description confirms only an application crash so A:H with C:N/I:N, though vendor asserts C:H/I:H for UAF code-execution potential.
Primary rating from Vendor (Foxit).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Reader and Foxit PDF Editor are affected by a high-severity vulnerability that can crash the application when a user opens a maliciously crafted PDF. The demonstrated impact identified at this time is availability disruption rather than confirmed code execution, and there is no public exploit identified at time of analysis, but broad deployment and common PDF JavaScript defaults mean organizations should still act. Leadership should care because an unpatched, user-interaction-dependent flaw can cause operational disruption and productivity loss, with potential escalation if the vendor's broader impact assessment is later validated.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling PDF JavaScript in Foxit PDF Reader and Foxit PDF Editor, opening untrusted PDFs only in protected or sandboxed environments, restricting PDF sources to trusted parties, and monitoring the vendor advisory for a fixed release; apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB