Foxit Pdf Editor
Monthly
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects carry malformed optional-content (OCG) attributes, which the program processes while rendering the page image and which causes it to dereference an already-freed internal data structure. The reliably reproducible outcome described by the vendor is an application crash (denial of service); because the defect is a memory-corruption class (CWE-416), code execution in the context of the user may be possible but would require additional heap grooming that is not demonstrated in the available data. Exploitation requires local delivery of the malicious file and a victim to open it (AV:L, UI:R), while no authentication or privileges are needed on the attacker side (PR:N); the vendor-rated CVSS 3.1 base score is 7.8 (High). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that includes JavaScript triggered by page-visibility events. The reentrant execution leads the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash. Exploitation requires user interaction (the victim must open the malicious file) and JavaScript must be enabled, but no public exploit code or active exploitation has been identified at time of analysis; the independent assessment confirms only availability impact (crash), not code execution or data compromise.
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading to memory corruption and potential code execution in the user's context. The attack requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and depends on JavaScript execution being enabled; no public exploit identified at time of analysis.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader is triggered when a victim opens a specially crafted PDF: embedded JavaScript rewrites annotation rich-text attributes with malformed font data, and a freed object is then dereferenced during automatic annotation appearance reconstruction, crashing the application at minimum and, per the vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), potentially permitting code execution in the user's context. Exploitation is strictly client-side and requires the user to open the malicious file (UI:R) with PDF scripting active; no privileges are required (PR:N), and there is no network-remote trigger. The provided intelligence includes no CISA KEV listing and no public exploit code, so the status is no public exploit identified at time of analysis; the description demonstrates only a crash, while full code execution is asserted by the vendor CVSS rating but not evidenced in the available technical detail.
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.
Crafted PDF files can trigger a memory-corruption condition in the FileOpen (DRM) plugin of Foxit PDF Editor and Foxit PDF Reader, exploiting inadequate validation of encryption metadata to dereference an invalid internal pointer. Successful exploitation requires a victim to open a malicious PDF, after which the flaw may allow arbitrary code execution in the context of the local user; the vendor qualifies that code execution is only potentially achievable versus a crash. No public exploit identified at time of analysis, and no authentication is needed on the attacker side.
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an embedded attachment to a directory outside the intended secure area when the document is opened by a local user. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-73) and requires the victim to open the malicious file, so it is user-interaction-gated rather than remotely triggerable, and no authentication is required of the attacker (PR:N). The practical consequence is arbitrary file write under the privileges of the Foxit process, which can escalate into code execution only if the attacker manages to land a file in an execution-relevant location such as a startup or autorun path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption while the application processes JavaScript array objects, potentially crashing the viewer or achieving arbitrary code execution in the context of the logged-on user. Exploitation is client-side only: the attacker must lure a victim into opening a malicious PDF with JavaScript execution enabled in the product (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and there is no privilege prerequisite or network-service exposure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; turning the use-after-free into reliable code execution additionally depends on attacker-controlled heap state, which is the principal limiting factor beyond the mandatory user interaction.
Opening a malicious PDF in Foxit PDF Editor or Foxit PDF Reader can corrupt memory and terminate the application: the document forces a page-structure change while the file is being rendered, so the page-tree logic accesses a page object that has already been released (CWE-416, use-after-free). Rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw requires no authentication on the victim's side but does require the user to open the crafted file, making social engineering the sole delivery gate. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets an attacker embed traversal sequences in a PDF so that files are written outside their intended location when the document is opened or previewed, with a conditional path from that arbitrary-file-write primitive to code execution. Rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is a client-side parsing flaw: no authentication is required, but user interaction is mandatory and there is no network-facing or default-service exposure, so risk is bounded to users who process untrusted PDFs. No public exploit identified at time of analysis, and escalation to code execution remains conditional on a viable write target.
Memory corruption in Foxit PDF Editor and Reader arises from a heap-based out-of-bounds write (CWE-787) that occurs when the application renders a Circle annotation with a malformed 'Cloudy' appearance stream inside a crafted PDF. The flaw stems from insufficient validation of the annotation's appearance geometry during rendering, requiring the victim to open a malicious file (UI:R) with no privileges needed (PR:N). CVSS is 7.8, but no public exploit code has been identified at time of analysis, and the need for user interaction plus a deliberately malformed annotation structure limits practical, widespread exploitation.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader enables a crafted PDF containing embedded JavaScript to reference form fields after they have been released, causing memory corruption that crashes the application and, given the high confidentiality, integrity, and availability impact in the CVSS vector, could potentially lead to code execution. Exploitation requires the victim to open the malicious file (UI:R) on a local system (AV:L) and does not require authentication (PR:N); environments that disable PDF JavaScript execution are not affected by this specific trigger. No public exploit code or confirmed active exploitation is identified at time of analysis.
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91798, CVSS 3.1 8.8) lets an already-authenticated, low-privileged local user abuse an insecurely permitted configuration file (CWE-732) to have the elevated daemon execute arbitrary script content with SYSTEM/root-level rights. Because the attacker must already hold a session on the host and the impact crosses a privilege boundary, the vector is AV:L/PR:L/UI:N/S:C with full confidentiality, integrity, and availability impact; no remote attack path exists, and no public exploit code was identified at time of analysis. Any host running a vulnerable Foxit build with the update daemon installed and the loosely permissioned configuration file present is exposed, making this most relevant to multi-user workstations, VDI, and terminal-server environments where unprivileged users share a machine with a privileged updater.
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic can bypass TLS certificate validation and update package integrity checks, allowing a forged update to be accepted and executed with system privileges. Exploitation is materially constrained: the client must both be intercepted and perform an update check/download in that window, which is why the CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector scores AC:H, and no authentication (PR:N) or user interaction (UI:N) is required. Affected builds are Foxit PDF Editor 2026.2 and earlier, 14.0.7 and earlier, and 13.2.6 and earlier, plus Foxit PDF Reader 2026.2 and earlier; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis, EPSS is low at 0.13% (3rd percentile), and CISA's SSVC rates the technical impact as total while noting exploitation and automability as none/no.
Local privilege escalation in Foxit PDF Editor (versions 14.0.7, 13.2.6 and 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) lets an attacker who already has low-privileged local code execution swap the staged update package between download and high-privilege extraction, yielding arbitrary code execution as SYSTEM/admin. The root cause is a time-of-check-to-time-of-use race (CWE-367) combined with insufficient file locking and missing integrity validation on the update package, consistent with the CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV negative; SSVC Exploitation: none), and EPSS is only 0.13% (3rd percentile); the attacker must also win a timing race during an in-progress update cycle, consistent with SSVC Automatable: no, making this a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitable remote flaw.
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.
Use-after-free in the annotation-handling code of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF containing embedded JavaScript to trigger reentrant deletion of an annotation object, causing the freed memory to be dereferenced afterwards - crashing the application and, given the CVSS vector's high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), creating memory-corruption conditions that could potentially be steered toward code execution. The attack is client-side and file-based: per the vector (AV:L/AC:L/PR:N/UI:R) no authentication or privileges are required, but the attacker cannot reach the application remotely and the victim must open the malicious document, with JavaScript execution permitted in the reader for the vulnerable code path to be reached. There is no public exploit code identified at time of analysis and no confirmation of active exploitation; no EPSS score was provided with the source data.
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to corrupt process memory and potentially achieve remote code execution when the victim opens the file. Exploitation requires user interaction (the document must be opened and the malicious 3D model or GIF texture must actually be rendered) and is delivered through the local file/processing path (AV:L), while no application-level authentication is required (PR:N). No confirmed active exploitation and no public exploit code were identified at time of analysis; Foxit directs users to its security bulletins page for version guidance.
Opening a specially crafted PDF with malformed form fields in Foxit PDF Editor or Foxit PDF Reader can trigger a use-after-free (CWE-416) that crashes the application and corrupts memory. The flaw is reachable only through the local, user-interaction vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H per independent assessment), meaning an attacker must first socially engineer a victim into opening a malicious document - there is no remote or unauthenticated network trigger, and no public exploit code was identified at time of analysis. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data, so the practical impact should be treated as availability loss with potential secondary confidentiality/integrity effects rather than a proven full remote code execution chain.
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1/14.0.4 and earlier) allows a crafted PDF containing embedded JavaScript to free page objects and trigger a dangling write to pop-up annotation objects. An attacker who convinces a user to open a malicious document can crash the application and potentially achieve arbitrary code execution in the user's context. No public exploit identified at time of analysis; the flaw was reported privately by Foxit.
Denial-of-service (and potential memory-corruption) in Foxit PDF Editor (≤14.0.4 / ≤13.2.4 / ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) arises when a crafted PDF's embedded JavaScript rewrites the document to alter the page structure, freeing the underlying page objects while the thumbnail renderer continues to reference them - a classic use-after-free (CWE-416). A victim who merely opens the file triggers the dangling reference, causing an application crash and, given the CVSS confidentiality/integrity impact, a plausible path to code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1 and earlier) occurs when a victim opens a crafted PDF whose embedded JavaScript deletes the current page, after which subsequent scripts dereference now-freed document-view properties and crash the application. This is a CWE-416 use-after-free reported by Foxit; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The documented impact is an application crash, though the underlying memory-corruption class warrants caution about potential escalation.
Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader (Windows) lets a low-privileged user place executable files that a high-privilege process later runs directly, yielding code execution as NT AUTHORITY\SYSTEM. The flaw stems from an untrusted search path (CWE-427) where the application loads and executes attacker-writable binaries without validating their origin. There is no public exploit identified at time of analysis, EPSS is low (0.11%, 2nd percentile), and SSVC reports no observed exploitation, so this is a locally-exploitable escalation rather than a remotely wormable threat.
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor lets a crafted PDF containing JavaScript trigger stale field-pointer dereferences after the script deletes form fields, corrupting memory and crashing the application. The flaw affects Foxit PDF Editor 14.0.4 and earlier and Foxit PDF Reader 2026.1.1 and earlier and requires the victim to open a malicious file. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Foxit's own CVSS of 7.8 (C:H/I:H/A:H) implies potential code execution beyond the crash described.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1, 13.2.4, 14.0.4 and earlier) allows attackers to crash the application and potentially corrupt memory when a victim opens a malicious PDF whose embedded JavaScript walks a deliberately damaged form-field tree. The bug is a use-after-free (CWE-416): field traversal leaves the program holding a freed/invalid form object, and dereferencing that invalid pointer causes the crash. No public exploit identified at time of analysis; disclosure originates from Foxit's own security bulletin.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF to trigger a use-after-free through the embedded JavaScript engine, where a form field object is deleted and then re-accessed, crashing the application. The flaw affects PDF Editor through 13.2.4, 14.0.4, and 2026.1.1, and PDF Reader through 2026.1.1, and was reported by Foxit. No public exploit has been identified at time of analysis, though CVSS scores the impact as high across confidentiality, integrity, and availability, implying potential exploitation beyond a simple crash.
Use-after-free memory corruption in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (through 14.0.4, 13.2.4, and 2026.1.1) allows a remote attacker to execute arbitrary code or crash the application when a victim opens a maliciously crafted PDF. The flaw stems from JavaScript-driven form modifications that leave page-related objects with incomplete lifecycle management, so the application dereferences freed/invalid objects on page-state changes. No public exploit identified at time of analysis, and it is not listed in CISA KEV; while the description emphasizes a crash, the CVSS vector rates full confidentiality, integrity, and availability impact, consistent with exploitable memory corruption.
Memory corruption in Foxit PDF Reader (≤2026.1.1) and Foxit PDF Editor (≤14.0.4, ≤13.2.4, and ≤2026.1.1) allows an attacker to trigger a use-after-free when a victim opens a maliciously crafted PDF whose hyperlink annotation objects use abnormal relationships and field combinations. The flaw manifests as an invalid pointer write during object destruction; while the vendor description only confirms an application crash, the vendor-assigned CVSS (C:H/I:H/A:H) and CWE-416 classification indicate potential for arbitrary code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory-corruption (buffer overflow) in Foxit PDF Reader and Foxit PDF Editor arises when the digital-signature plugin processes abnormally constructed signature objects: JavaScript triggers signature verification, but the plugin copies an anomalous string without validating its arguments, corrupting memory. A local victim who opens a crafted PDF is affected, and while the vendor describes the outcome as an application crash, the CVSS High confidentiality/integrity/availability impacts indicate potential for code execution. No public exploit identified at time of analysis.
Memory-corruption crash (and potential code execution) in Foxit PDF Reader and Foxit PDF Editor occurs when a PDF's embedded JavaScript writes annotation attributes without sufficient object-type and argument validation, corrupting the internal annotation structure so the application faults during subsequent object release (CWE-763). Local exploitation requires a user to open a crafted PDF; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. The vendor rates full confidentiality, integrity, and availability impact (CVSS 7.8), though Foxit tags it as Denial of Service.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to crash the application when its embedded JavaScript resets annotation status and then triggers a reset-form additional action, causing the parser to re-enter and dereference freed objects. Local victims who open a malicious document are affected; the CVSS 3.1 base score is 7.8. No public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Foxit PDF Editor and Foxit PDF Reader arises when the application renders a PDF containing cloud-style annotation/border appearances, because the code that builds that geometry omits an upper-bound limit and consistency checks. A local attacker who convinces a user to open a malicious PDF can trigger an out-of-bounds array access that crashes the application; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV. Although the NVD vector claims high confidentiality and integrity impact, the vendor description and tags describe only a crash.
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF to crash the application when its embedded JavaScript deletes pages and removes attachment annotations while the attachment panel still references freed pointers. A victim must open the malicious document (UI:R), and no public exploit has been identified at time of analysis. Although the reported behavior is an application crash, Foxit's own CVSS scoring rates confidentiality, integrity, and availability all High, implying potential for code execution beyond denial of service.
Type-confusion memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing an abnormal annotation object - one referenced by other objects - to bypass proper type checking during parsing, corrupting memory and crashing the application. Exploitation requires a user to open the malicious file locally (UI:R); there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the current confirmed impact is denial of service, though the CWE-843 class leaves open potential for code execution.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) allows an attacker to corrupt object state and read an illegal memory address when a victim opens a crafted PDF that manipulates form-field properties via embedded JavaScript. The immediate observed impact is an application crash (denial of service), but the CWE-416 root cause and the vendor's CVSS confidentiality/integrity ratings indicate potential for arbitrary code execution in the context of the user. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Foxit, the reporting vendor, has issued a security bulletin covering the affected versions.
Use-after-free during PDF field processing in Foxit PDF Editor and Foxit PDF Reader allows a crafted document to delete the current page and then reuse now-dangling field objects, causing an illegal memory read and application crash. Affects Foxit PDF Editor through 14.0.4 / 2026.1.1 and Foxit PDF Reader through 2026.1.1; exploitation requires a user to open a malicious PDF. No public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor (Foxit) reported it and tags it primarily as denial of service / memory corruption.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader is triggered when JavaScript embedded in a malicious PDF resets form fields and re-enters the interface, causing the application to invoke a method on a freed native object. An attacker who convinces a user to open a crafted PDF can crash the application, and because the flaw is a use-after-free (CWE-416), it carries potential for memory-corruption abuse beyond denial of service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing embedded JavaScript to trigger a use-after-free (CWE-416) when the script manipulates a list box field and the form is subsequently reset. A victim who merely opens the malicious document can have the application dereference a dangling pointer to freed form-field memory; Foxit itself reported the flaw and CVSS rates it 7.8. No public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis, though use-after-free in a scriptable PDF engine is a classic path toward code execution.
Out-of-bounds memory access in Foxit PDF Editor and Foxit PDF Reader occurs when the application parses a malformed Unity 3D object embedded in a PDF, resolving attacker-influenced data as a pointer and dereferencing it as a valid address. A victim who opens a crafted PDF triggers the flaw (CVSS 7.8, UI:R), which manifests as a crash but, given the CWE-787 out-of-bounds write classification and High confidentiality/integrity/availability impact, carries potential for memory corruption and code execution in the context of the current user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows local attackers to crash the application or potentially execute arbitrary code through specially crafted PDF files with malformed form field hierarchies. The vulnerability triggers when parsing logic misidentifies non-signature data as valid signatures, causing invalid memory writes during internal data structure construction. User interaction is required to open the malicious PDF document. No active exploitation has been identified at time of analysis, though the local attack vector and high CVSS score (7.8) warrant attention for endpoint security in environments handling untrusted PDF files.
DLL search path hijacking in Foxit PDF Editor and Foxit PDF Reader update services enables local privilege escalation to SYSTEM. Low-privileged authenticated users can plant malicious libraries in writable directories that are resolved during update checks, achieving arbitrary code execution with elevated privileges. CVSS 7.8 (High) with low attack complexity. No public exploit identified at time of analysis, EPSS data not provided.
Installer privilege escalation in Foxit PDF Reader and Foxit PDF Editor allows local authenticated users to execute arbitrary code with elevated system privileges via DLL search path manipulation. The installer's failure to use absolute paths for system executables enables attackers to plant malicious DLLs in user-writable directories that take precedence during installation, exploiting the trusted installer's elevated permissions. EPSS data not available; no public exploit identified at time of analysis; not listed in CISA KEV.
Use-after-free in Foxit PDF Reader and Editor allows arbitrary code execution when processing maliciously crafted PDF documents containing list box calculation arrays. The vulnerability (CVSS 7.8) occurs when stale references to deleted or re-created page/form objects persist in calculation logic, enabling local attackers to execute code with user privileges when victims open weaponized PDFs. No public exploit identified at time of analysis, though the memory corruption primitive is well-understood by exploit developers.
A crafted PDF opened in Foxit PDF Editor or Foxit PDF Reader can read content from other documents loaded in the same application process and transmit it to an external destination, because Foxit's JavaScript interface omits the attribute authorization checks required by the specification. The attack is local and requires the victim to open the file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 4.7): a second sensitive PDF must already be open in the same process for the cross-document read to succeed, and the malicious document must run with the elevated privileges of a trusted document. There is no memory corruption, so the impact is confined to confidentiality (C:H/I:N/A:N); no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Reported by Foxit and mapped to CWE-668 (Exposure of Resource to Wrong Sphere), this is a genuine but constrained information-disclosure flaw rather than a remotely reachable compromise vector.
Credential-hash disclosure in Foxit PDF Editor and Foxit PDF Reader occurs when a crafted PDF triggers outbound SMB authentication without a security prompt, bypassing the missing permission check in secure reading mode. An attacker can lure a user into opening the file, causing the victim's NTLM credential hash to be sent to an attacker-controlled SMB/UNC endpoint; no authentication or elevated privileges are required on the target, but user interaction is mandatory. The independent assessment scores this as network-vector credential disclosure (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N), and no public exploit has been identified at time of analysis; real-world impact is greatest where outbound SMB/port 445 is permitted, and egress filtering substantially reduces risk.
Heap-based out-of-bounds write in Foxit PDF Editor/Reader allows attackers to corrupt memory when a victim opens a PDF containing a crafted WebP image, potentially leading to code execution or a crash. The flaw stems from improper handling of bitmap stride and target buffer formats (CWE-787) and requires user interaction to open the malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or active exploitation has been identified at time of analysis.
Opening a specially crafted PDF in Foxit PDF Reader or Foxit PDF Editor can trigger an arithmetic underflow while the application parses an image soft-mask, leading to a heap-based out-of-bounds read that discloses limited memory contents and terminates the application in a crash. The attack is file-based and requires the victim to open the malicious document (AV:L, UI:R); no authentication is needed (PR:N), but there is no network-remote or automatic trigger, and the impact is capped at a crash plus limited information disclosure rather than code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuine but low-priority issue for most environments.
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a crafted PDF contains image objects whose compression metadata is inconsistent with the actual image data, causing an undersized buffer and a crash during rendering. The flaw has a CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning an unauthenticated local attacker must deliver a malicious PDF and convince a user to open it; the realistic outcome is application crash with possible minor memory disclosure, not remote code execution. No public exploit identified at time of analysis, and no active exploitation is reported in the provided data.
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a user opens a crafted PDF containing a malformed image mask whose metadata is inconsistent with its actual pixel and alpha data, causing incorrect alpha-channel processing during rendering and resulting in an application crash with a limited read of adjacent heap memory. The issue is local and requires user interaction - the victim must open the file - with no authentication required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, score 6.1), and the impact ceiling is denial of service plus minor information exposure rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and the CVE is not listed in CISA KEV; CPE data marks both Foxit PDF Editor and Foxit PDF Reader as affected across all versions.
Content spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementally updated PDFs without invalidating an existing digital signature, so the document continues to appear validly signed. Publicly available exploit code exists for this CWE-347 signature verification flaw, but no active exploitation has been confirmed. The attack requires user interaction (opening the document) and is high complexity (AC:H) but unauthenticated (PR:N), yielding high integrity impact without confidentiality or availability loss.
Heap-based out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader can crash the application and may disclose limited heap memory contents when a user opens a crafted PDF containing embedded JavaScript that triggers an integer underflow during a wide-string deletion operation. Exploitation is local and requires user interaction: the victim must open the malicious PDF and JavaScript execution must be enabled, and the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) indicates no privileges are required but no remote network path. No public exploit identified at time of analysis; confidentiality impact is low and availability impact is high, making this a modest-severity issue that primarily causes denial of service.
Opening a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor can crash the application through a use-after-free of an internal page object, because JavaScript that triggers reentrant page-event processing during annotation enumeration can free the page while a reference to it is still held. The vendor-approved CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is local, requires no authentication, and mandates user interaction - the victim must open the file - while our independent assessment scores the demonstrated impact as availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), i.e. a denial-of-service/crash rather than demonstrated code execution. Exposure depends on PDF JavaScript being enabled in the reader, a common default but a configurable setting; no public exploit code has been identified and the issue has not been added to CISA KEV, so this is not confirmed active exploitation.
Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader allows a local attacker to crash the application and potentially expose adjacent memory contents by delivering a specially crafted PDF containing malicious JavaScript. The JavaScript manipulates page and document objects to desynchronize internal page-related state from the renderer's trusted page count; when the renderer subsequently accesses page objects using the stale index, it reads beyond valid memory bounds. No public exploit identified at time of analysis and no CISA KEV listing, but the broad affected version ranges across multiple major release branches (13.x, 14.x, and 2026.x) means a large proportion of unpatched Foxit deployments are exposed.
Foxit PDF Reader and PDF Editor crash with potential memory disclosure when processing maliciously crafted PDF documents containing JavaScript that causes reentrancy during page opening or form formatting. The reentrancy leaves the document object in an inconsistent state; when the application subsequently attempts to dereference stale page metadata, it reads from an invalid memory address (CWE-125 out-of-bounds read), resulting in application termination and limited memory content exposure. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a local user interaction to open a crafted PDF file.
Out-of-bounds read in Foxit PDF Reader and PDF Editor allows a local attacker to crash the application and potentially disclose limited memory contents by delivering a specially crafted PDF containing a malformed image object. The vulnerability triggers when the renderer encounters an abnormal image object, causes it to enter an incorrect processing branch, and subsequently dereferences an invalid buffer pointer during scan line conversion. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS availability impact is rated High, meaning successful exploitation reliably causes application termination.
Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader crashes the application and exposes limited memory contents when a victim opens a specially crafted PDF embedding a semantically malformed color space function. Affected versions span multiple branches across both Editor and Reader products, confirmed through EUVD-2026-42198. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and file-based delivery mechanism make this a plausible phishing lure in targeted campaigns against organizations relying on Foxit products.
XXE injection in Foxit PDF Editor and Foxit PDF Reader exposes any local file readable by the victim user when they open a maliciously crafted document disguised as a PDF. The parser processes documents that are not structurally valid PDFs, resolving attacker-controlled external XML entities that reference local filesystem paths via file:// or similar protocols, enabling out-of-band exfiltration of sensitive local files. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by user interaction (UI:R), limiting opportunistic mass exploitation.
Out-of-bounds read in Foxit PDF Editor and PDF Reader during PRC (Product Representation Compact) 3D content parsing crashes the application and leaks limited memory content. Affects multiple concurrent release trains including versions 2026.1.1, 14.0.4, and 13.2.4 and earlier. Exploitation requires a victim to open a specially crafted PDF containing a malicious PRC entity - no public exploit has been identified at time of analysis.
Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader's PRC 3D file header parser crashes the application and may leak process memory when a victim opens a specially crafted PDF. Affected version ranges span Foxit PDF Reader through 2026.1.1 and multiple Foxit PDF Editor release branches through 13.2.4, 14.0.4, and 2026.1.1. No public exploit code or confirmed active exploitation has been identified at time of analysis; the CVSS availability impact is rated High due to a reliable application crash on trigger, with a minor confidentiality component from out-of-bounds memory exposure.
Unhandled exception in Foxit PDF Editor and Foxit PDF Reader allows local denial of service when a user opens a maliciously crafted PDF file with insufficient parameter verification, causing the application to crash via an uncaught std::invalid_argument exception. The vulnerability requires user interaction (opening a file) and local file access but affects all versions of both products without authentication requirements.
Modal dialog reentry vulnerability in Foxit PDF Editor and Reader allows local attackers to trigger UI freeze and denial of service by supplying a crafted PDF document with a malicious action chain, requiring user interaction to open the file. The vulnerability stems from improper control flow management in document action handling and results in application unresponsiveness on the main thread. No public exploit code or active exploitation has been identified at the time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free vulnerability in Foxit PDF Editor and PDF Reader allows local attackers to crash the application by manipulating document page lifecycle events, causing internal component states to desynchronize and subsequent operations to reference invalidated memory objects. Attack requires user interaction to open a malicious PDF file and does not enable information disclosure or code execution; impact is denial of service with CVSS 5.5 (medium severity). No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application or execute arbitrary code by opening a crafted XFA PDF file during calculate event processing. The vulnerability requires user interaction (opening a malicious PDF) but impacts both products across all versions listed in CPE data. No public exploit code or active exploitation has been confirmed at this time.
Foxit PDF Editor allows PDF JavaScript and document actions (WillPrint/DidPrint) to modify form fields, annotations, and optional content groups immediately before or after redaction, encryption, or printing, potentially causing sensitive content to remain visible or unencrypted despite user expectations. The vulnerability affects all versions of Foxit PDF Editor and requires local access with user interaction (opening a malicious PDF). CVSS score is 4.7 with high confidentiality impact; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Denial of service in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application by opening a crafted PDF containing a stamp annotation with missing appearance (AP) data. The vulnerability stems from insufficient validation before dereferencing annotation objects, triggering a null pointer exception. No public exploit code has been identified, and patch availability has not been confirmed from available advisory data.
Foxit PDF Editor and PDF Reader are vulnerable to denial of service via uncontrolled recursion in maliciously crafted PDF documents containing cyclic object references in pages and annotations. When such documents are processed by APIs performing deep object traversal (such as SOAP handlers), the applications exhaust stack memory and crash. The vulnerability requires only local access and no user interaction beyond opening a malicious PDF, making it a practical attack vector for local denial of service.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader allows local attackers to achieve arbitrary code execution by crafting malicious JavaScript that manipulates document zoom and page state, causing stale view cache pointers to be dereferenced after the underlying view object is destroyed. The vulnerability requires user interaction (opening a crafted PDF) and local access, with a CVSS score of 5.5 reflecting denial-of-service impact, though the underlying memory corruption (CWE-416) and RCE tags indicate higher real-world severity under exploitation.
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects carry malformed optional-content (OCG) attributes, which the program processes while rendering the page image and which causes it to dereference an already-freed internal data structure. The reliably reproducible outcome described by the vendor is an application crash (denial of service); because the defect is a memory-corruption class (CWE-416), code execution in the context of the user may be possible but would require additional heap grooming that is not demonstrated in the available data. Exploitation requires local delivery of the malicious file and a victim to open it (AV:L, UI:R), while no authentication or privileges are needed on the attacker side (PR:N); the vendor-rated CVSS 3.1 base score is 7.8 (High). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that includes JavaScript triggered by page-visibility events. The reentrant execution leads the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash. Exploitation requires user interaction (the victim must open the malicious file) and JavaScript must be enabled, but no public exploit code or active exploitation has been identified at time of analysis; the independent assessment confirms only availability impact (crash), not code execution or data compromise.
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading to memory corruption and potential code execution in the user's context. The attack requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and depends on JavaScript execution being enabled; no public exploit identified at time of analysis.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader is triggered when a victim opens a specially crafted PDF: embedded JavaScript rewrites annotation rich-text attributes with malformed font data, and a freed object is then dereferenced during automatic annotation appearance reconstruction, crashing the application at minimum and, per the vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), potentially permitting code execution in the user's context. Exploitation is strictly client-side and requires the user to open the malicious file (UI:R) with PDF scripting active; no privileges are required (PR:N), and there is no network-remote trigger. The provided intelligence includes no CISA KEV listing and no public exploit code, so the status is no public exploit identified at time of analysis; the description demonstrates only a crash, while full code execution is asserted by the vendor CVSS rating but not evidenced in the available technical detail.
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.
Crafted PDF files can trigger a memory-corruption condition in the FileOpen (DRM) plugin of Foxit PDF Editor and Foxit PDF Reader, exploiting inadequate validation of encryption metadata to dereference an invalid internal pointer. Successful exploitation requires a victim to open a malicious PDF, after which the flaw may allow arbitrary code execution in the context of the local user; the vendor qualifies that code execution is only potentially achievable versus a crash. No public exploit identified at time of analysis, and no authentication is needed on the attacker side.
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an embedded attachment to a directory outside the intended secure area when the document is opened by a local user. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-73) and requires the victim to open the malicious file, so it is user-interaction-gated rather than remotely triggerable, and no authentication is required of the attacker (PR:N). The practical consequence is arbitrary file write under the privileges of the Foxit process, which can escalate into code execution only if the attacker manages to land a file in an execution-relevant location such as a startup or autorun path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption while the application processes JavaScript array objects, potentially crashing the viewer or achieving arbitrary code execution in the context of the logged-on user. Exploitation is client-side only: the attacker must lure a victim into opening a malicious PDF with JavaScript execution enabled in the product (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and there is no privilege prerequisite or network-service exposure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; turning the use-after-free into reliable code execution additionally depends on attacker-controlled heap state, which is the principal limiting factor beyond the mandatory user interaction.
Opening a malicious PDF in Foxit PDF Editor or Foxit PDF Reader can corrupt memory and terminate the application: the document forces a page-structure change while the file is being rendered, so the page-tree logic accesses a page object that has already been released (CWE-416, use-after-free). Rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw requires no authentication on the victim's side but does require the user to open the crafted file, making social engineering the sole delivery gate. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets an attacker embed traversal sequences in a PDF so that files are written outside their intended location when the document is opened or previewed, with a conditional path from that arbitrary-file-write primitive to code execution. Rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is a client-side parsing flaw: no authentication is required, but user interaction is mandatory and there is no network-facing or default-service exposure, so risk is bounded to users who process untrusted PDFs. No public exploit identified at time of analysis, and escalation to code execution remains conditional on a viable write target.
Memory corruption in Foxit PDF Editor and Reader arises from a heap-based out-of-bounds write (CWE-787) that occurs when the application renders a Circle annotation with a malformed 'Cloudy' appearance stream inside a crafted PDF. The flaw stems from insufficient validation of the annotation's appearance geometry during rendering, requiring the victim to open a malicious file (UI:R) with no privileges needed (PR:N). CVSS is 7.8, but no public exploit code has been identified at time of analysis, and the need for user interaction plus a deliberately malformed annotation structure limits practical, widespread exploitation.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader enables a crafted PDF containing embedded JavaScript to reference form fields after they have been released, causing memory corruption that crashes the application and, given the high confidentiality, integrity, and availability impact in the CVSS vector, could potentially lead to code execution. Exploitation requires the victim to open the malicious file (UI:R) on a local system (AV:L) and does not require authentication (PR:N); environments that disable PDF JavaScript execution are not affected by this specific trigger. No public exploit code or confirmed active exploitation is identified at time of analysis.
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91798, CVSS 3.1 8.8) lets an already-authenticated, low-privileged local user abuse an insecurely permitted configuration file (CWE-732) to have the elevated daemon execute arbitrary script content with SYSTEM/root-level rights. Because the attacker must already hold a session on the host and the impact crosses a privilege boundary, the vector is AV:L/PR:L/UI:N/S:C with full confidentiality, integrity, and availability impact; no remote attack path exists, and no public exploit code was identified at time of analysis. Any host running a vulnerable Foxit build with the update daemon installed and the loosely permissioned configuration file present is exposed, making this most relevant to multi-user workstations, VDI, and terminal-server environments where unprivileged users share a machine with a privileged updater.
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic can bypass TLS certificate validation and update package integrity checks, allowing a forged update to be accepted and executed with system privileges. Exploitation is materially constrained: the client must both be intercepted and perform an update check/download in that window, which is why the CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector scores AC:H, and no authentication (PR:N) or user interaction (UI:N) is required. Affected builds are Foxit PDF Editor 2026.2 and earlier, 14.0.7 and earlier, and 13.2.6 and earlier, plus Foxit PDF Reader 2026.2 and earlier; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis, EPSS is low at 0.13% (3rd percentile), and CISA's SSVC rates the technical impact as total while noting exploitation and automability as none/no.
Local privilege escalation in Foxit PDF Editor (versions 14.0.7, 13.2.6 and 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) lets an attacker who already has low-privileged local code execution swap the staged update package between download and high-privilege extraction, yielding arbitrary code execution as SYSTEM/admin. The root cause is a time-of-check-to-time-of-use race (CWE-367) combined with insufficient file locking and missing integrity validation on the update package, consistent with the CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV negative; SSVC Exploitation: none), and EPSS is only 0.13% (3rd percentile); the attacker must also win a timing race during an in-progress update cycle, consistent with SSVC Automatable: no, making this a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitable remote flaw.
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.
Use-after-free in the annotation-handling code of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF containing embedded JavaScript to trigger reentrant deletion of an annotation object, causing the freed memory to be dereferenced afterwards - crashing the application and, given the CVSS vector's high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), creating memory-corruption conditions that could potentially be steered toward code execution. The attack is client-side and file-based: per the vector (AV:L/AC:L/PR:N/UI:R) no authentication or privileges are required, but the attacker cannot reach the application remotely and the victim must open the malicious document, with JavaScript execution permitted in the reader for the vulnerable code path to be reached. There is no public exploit code identified at time of analysis and no confirmation of active exploitation; no EPSS score was provided with the source data.
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to corrupt process memory and potentially achieve remote code execution when the victim opens the file. Exploitation requires user interaction (the document must be opened and the malicious 3D model or GIF texture must actually be rendered) and is delivered through the local file/processing path (AV:L), while no application-level authentication is required (PR:N). No confirmed active exploitation and no public exploit code were identified at time of analysis; Foxit directs users to its security bulletins page for version guidance.
Opening a specially crafted PDF with malformed form fields in Foxit PDF Editor or Foxit PDF Reader can trigger a use-after-free (CWE-416) that crashes the application and corrupts memory. The flaw is reachable only through the local, user-interaction vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H per independent assessment), meaning an attacker must first socially engineer a victim into opening a malicious document - there is no remote or unauthenticated network trigger, and no public exploit code was identified at time of analysis. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data, so the practical impact should be treated as availability loss with potential secondary confidentiality/integrity effects rather than a proven full remote code execution chain.
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1/14.0.4 and earlier) allows a crafted PDF containing embedded JavaScript to free page objects and trigger a dangling write to pop-up annotation objects. An attacker who convinces a user to open a malicious document can crash the application and potentially achieve arbitrary code execution in the user's context. No public exploit identified at time of analysis; the flaw was reported privately by Foxit.
Denial-of-service (and potential memory-corruption) in Foxit PDF Editor (≤14.0.4 / ≤13.2.4 / ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) arises when a crafted PDF's embedded JavaScript rewrites the document to alter the page structure, freeing the underlying page objects while the thumbnail renderer continues to reference them - a classic use-after-free (CWE-416). A victim who merely opens the file triggers the dangling reference, causing an application crash and, given the CVSS confidentiality/integrity impact, a plausible path to code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1 and earlier) occurs when a victim opens a crafted PDF whose embedded JavaScript deletes the current page, after which subsequent scripts dereference now-freed document-view properties and crash the application. This is a CWE-416 use-after-free reported by Foxit; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The documented impact is an application crash, though the underlying memory-corruption class warrants caution about potential escalation.
Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader (Windows) lets a low-privileged user place executable files that a high-privilege process later runs directly, yielding code execution as NT AUTHORITY\SYSTEM. The flaw stems from an untrusted search path (CWE-427) where the application loads and executes attacker-writable binaries without validating their origin. There is no public exploit identified at time of analysis, EPSS is low (0.11%, 2nd percentile), and SSVC reports no observed exploitation, so this is a locally-exploitable escalation rather than a remotely wormable threat.
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor lets a crafted PDF containing JavaScript trigger stale field-pointer dereferences after the script deletes form fields, corrupting memory and crashing the application. The flaw affects Foxit PDF Editor 14.0.4 and earlier and Foxit PDF Reader 2026.1.1 and earlier and requires the victim to open a malicious file. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Foxit's own CVSS of 7.8 (C:H/I:H/A:H) implies potential code execution beyond the crash described.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor (versions 2026.1.1, 13.2.4, 14.0.4 and earlier) allows attackers to crash the application and potentially corrupt memory when a victim opens a malicious PDF whose embedded JavaScript walks a deliberately damaged form-field tree. The bug is a use-after-free (CWE-416): field traversal leaves the program holding a freed/invalid form object, and dereferencing that invalid pointer causes the crash. No public exploit identified at time of analysis; disclosure originates from Foxit's own security bulletin.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF to trigger a use-after-free through the embedded JavaScript engine, where a form field object is deleted and then re-accessed, crashing the application. The flaw affects PDF Editor through 13.2.4, 14.0.4, and 2026.1.1, and PDF Reader through 2026.1.1, and was reported by Foxit. No public exploit has been identified at time of analysis, though CVSS scores the impact as high across confidentiality, integrity, and availability, implying potential exploitation beyond a simple crash.
Use-after-free memory corruption in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (through 14.0.4, 13.2.4, and 2026.1.1) allows a remote attacker to execute arbitrary code or crash the application when a victim opens a maliciously crafted PDF. The flaw stems from JavaScript-driven form modifications that leave page-related objects with incomplete lifecycle management, so the application dereferences freed/invalid objects on page-state changes. No public exploit identified at time of analysis, and it is not listed in CISA KEV; while the description emphasizes a crash, the CVSS vector rates full confidentiality, integrity, and availability impact, consistent with exploitable memory corruption.
Memory corruption in Foxit PDF Reader (≤2026.1.1) and Foxit PDF Editor (≤14.0.4, ≤13.2.4, and ≤2026.1.1) allows an attacker to trigger a use-after-free when a victim opens a maliciously crafted PDF whose hyperlink annotation objects use abnormal relationships and field combinations. The flaw manifests as an invalid pointer write during object destruction; while the vendor description only confirms an application crash, the vendor-assigned CVSS (C:H/I:H/A:H) and CWE-416 classification indicate potential for arbitrary code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory-corruption (buffer overflow) in Foxit PDF Reader and Foxit PDF Editor arises when the digital-signature plugin processes abnormally constructed signature objects: JavaScript triggers signature verification, but the plugin copies an anomalous string without validating its arguments, corrupting memory. A local victim who opens a crafted PDF is affected, and while the vendor describes the outcome as an application crash, the CVSS High confidentiality/integrity/availability impacts indicate potential for code execution. No public exploit identified at time of analysis.
Memory-corruption crash (and potential code execution) in Foxit PDF Reader and Foxit PDF Editor occurs when a PDF's embedded JavaScript writes annotation attributes without sufficient object-type and argument validation, corrupting the internal annotation structure so the application faults during subsequent object release (CWE-763). Local exploitation requires a user to open a crafted PDF; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. The vendor rates full confidentiality, integrity, and availability impact (CVSS 7.8), though Foxit tags it as Denial of Service.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to crash the application when its embedded JavaScript resets annotation status and then triggers a reset-form additional action, causing the parser to re-enter and dereference freed objects. Local victims who open a malicious document are affected; the CVSS 3.1 base score is 7.8. No public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Foxit PDF Editor and Foxit PDF Reader arises when the application renders a PDF containing cloud-style annotation/border appearances, because the code that builds that geometry omits an upper-bound limit and consistency checks. A local attacker who convinces a user to open a malicious PDF can trigger an out-of-bounds array access that crashes the application; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV. Although the NVD vector claims high confidentiality and integrity impact, the vendor description and tags describe only a crash.
Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF to crash the application when its embedded JavaScript deletes pages and removes attachment annotations while the attachment panel still references freed pointers. A victim must open the malicious document (UI:R), and no public exploit has been identified at time of analysis. Although the reported behavior is an application crash, Foxit's own CVSS scoring rates confidentiality, integrity, and availability all High, implying potential for code execution beyond denial of service.
Type-confusion memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing an abnormal annotation object - one referenced by other objects - to bypass proper type checking during parsing, corrupting memory and crashing the application. Exploitation requires a user to open the malicious file locally (UI:R); there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the current confirmed impact is denial of service, though the CWE-843 class leaves open potential for code execution.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) allows an attacker to corrupt object state and read an illegal memory address when a victim opens a crafted PDF that manipulates form-field properties via embedded JavaScript. The immediate observed impact is an application crash (denial of service), but the CWE-416 root cause and the vendor's CVSS confidentiality/integrity ratings indicate potential for arbitrary code execution in the context of the user. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Foxit, the reporting vendor, has issued a security bulletin covering the affected versions.
Use-after-free during PDF field processing in Foxit PDF Editor and Foxit PDF Reader allows a crafted document to delete the current page and then reuse now-dangling field objects, causing an illegal memory read and application crash. Affects Foxit PDF Editor through 14.0.4 / 2026.1.1 and Foxit PDF Reader through 2026.1.1; exploitation requires a user to open a malicious PDF. No public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor (Foxit) reported it and tags it primarily as denial of service / memory corruption.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader is triggered when JavaScript embedded in a malicious PDF resets form fields and re-enters the interface, causing the application to invoke a method on a freed native object. An attacker who convinces a user to open a crafted PDF can crash the application, and because the flaw is a use-after-free (CWE-416), it carries potential for memory-corruption abuse beyond denial of service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing embedded JavaScript to trigger a use-after-free (CWE-416) when the script manipulates a list box field and the form is subsequently reset. A victim who merely opens the malicious document can have the application dereference a dangling pointer to freed form-field memory; Foxit itself reported the flaw and CVSS rates it 7.8. No public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis, though use-after-free in a scriptable PDF engine is a classic path toward code execution.
Out-of-bounds memory access in Foxit PDF Editor and Foxit PDF Reader occurs when the application parses a malformed Unity 3D object embedded in a PDF, resolving attacker-influenced data as a pointer and dereferencing it as a valid address. A victim who opens a crafted PDF triggers the flaw (CVSS 7.8, UI:R), which manifests as a crash but, given the CWE-787 out-of-bounds write classification and High confidentiality/integrity/availability impact, carries potential for memory corruption and code execution in the context of the current user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows local attackers to crash the application or potentially execute arbitrary code through specially crafted PDF files with malformed form field hierarchies. The vulnerability triggers when parsing logic misidentifies non-signature data as valid signatures, causing invalid memory writes during internal data structure construction. User interaction is required to open the malicious PDF document. No active exploitation has been identified at time of analysis, though the local attack vector and high CVSS score (7.8) warrant attention for endpoint security in environments handling untrusted PDF files.
DLL search path hijacking in Foxit PDF Editor and Foxit PDF Reader update services enables local privilege escalation to SYSTEM. Low-privileged authenticated users can plant malicious libraries in writable directories that are resolved during update checks, achieving arbitrary code execution with elevated privileges. CVSS 7.8 (High) with low attack complexity. No public exploit identified at time of analysis, EPSS data not provided.
Installer privilege escalation in Foxit PDF Reader and Foxit PDF Editor allows local authenticated users to execute arbitrary code with elevated system privileges via DLL search path manipulation. The installer's failure to use absolute paths for system executables enables attackers to plant malicious DLLs in user-writable directories that take precedence during installation, exploiting the trusted installer's elevated permissions. EPSS data not available; no public exploit identified at time of analysis; not listed in CISA KEV.
Use-after-free in Foxit PDF Reader and Editor allows arbitrary code execution when processing maliciously crafted PDF documents containing list box calculation arrays. The vulnerability (CVSS 7.8) occurs when stale references to deleted or re-created page/form objects persist in calculation logic, enabling local attackers to execute code with user privileges when victims open weaponized PDFs. No public exploit identified at time of analysis, though the memory corruption primitive is well-understood by exploit developers.
A crafted PDF opened in Foxit PDF Editor or Foxit PDF Reader can read content from other documents loaded in the same application process and transmit it to an external destination, because Foxit's JavaScript interface omits the attribute authorization checks required by the specification. The attack is local and requires the victim to open the file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 4.7): a second sensitive PDF must already be open in the same process for the cross-document read to succeed, and the malicious document must run with the elevated privileges of a trusted document. There is no memory corruption, so the impact is confined to confidentiality (C:H/I:N/A:N); no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Reported by Foxit and mapped to CWE-668 (Exposure of Resource to Wrong Sphere), this is a genuine but constrained information-disclosure flaw rather than a remotely reachable compromise vector.
Credential-hash disclosure in Foxit PDF Editor and Foxit PDF Reader occurs when a crafted PDF triggers outbound SMB authentication without a security prompt, bypassing the missing permission check in secure reading mode. An attacker can lure a user into opening the file, causing the victim's NTLM credential hash to be sent to an attacker-controlled SMB/UNC endpoint; no authentication or elevated privileges are required on the target, but user interaction is mandatory. The independent assessment scores this as network-vector credential disclosure (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N), and no public exploit has been identified at time of analysis; real-world impact is greatest where outbound SMB/port 445 is permitted, and egress filtering substantially reduces risk.
Heap-based out-of-bounds write in Foxit PDF Editor/Reader allows attackers to corrupt memory when a victim opens a PDF containing a crafted WebP image, potentially leading to code execution or a crash. The flaw stems from improper handling of bitmap stride and target buffer formats (CWE-787) and requires user interaction to open the malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or active exploitation has been identified at time of analysis.
Opening a specially crafted PDF in Foxit PDF Reader or Foxit PDF Editor can trigger an arithmetic underflow while the application parses an image soft-mask, leading to a heap-based out-of-bounds read that discloses limited memory contents and terminates the application in a crash. The attack is file-based and requires the victim to open the malicious document (AV:L, UI:R); no authentication is needed (PR:N), but there is no network-remote or automatic trigger, and the impact is capped at a crash plus limited information disclosure rather than code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuine but low-priority issue for most environments.
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a crafted PDF contains image objects whose compression metadata is inconsistent with the actual image data, causing an undersized buffer and a crash during rendering. The flaw has a CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning an unauthenticated local attacker must deliver a malicious PDF and convince a user to open it; the realistic outcome is application crash with possible minor memory disclosure, not remote code execution. No public exploit identified at time of analysis, and no active exploitation is reported in the provided data.
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a user opens a crafted PDF containing a malformed image mask whose metadata is inconsistent with its actual pixel and alpha data, causing incorrect alpha-channel processing during rendering and resulting in an application crash with a limited read of adjacent heap memory. The issue is local and requires user interaction - the victim must open the file - with no authentication required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, score 6.1), and the impact ceiling is denial of service plus minor information exposure rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and the CVE is not listed in CISA KEV; CPE data marks both Foxit PDF Editor and Foxit PDF Reader as affected across all versions.
Content spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementally updated PDFs without invalidating an existing digital signature, so the document continues to appear validly signed. Publicly available exploit code exists for this CWE-347 signature verification flaw, but no active exploitation has been confirmed. The attack requires user interaction (opening the document) and is high complexity (AC:H) but unauthenticated (PR:N), yielding high integrity impact without confidentiality or availability loss.
Heap-based out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader can crash the application and may disclose limited heap memory contents when a user opens a crafted PDF containing embedded JavaScript that triggers an integer underflow during a wide-string deletion operation. Exploitation is local and requires user interaction: the victim must open the malicious PDF and JavaScript execution must be enabled, and the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) indicates no privileges are required but no remote network path. No public exploit identified at time of analysis; confidentiality impact is low and availability impact is high, making this a modest-severity issue that primarily causes denial of service.
Opening a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor can crash the application through a use-after-free of an internal page object, because JavaScript that triggers reentrant page-event processing during annotation enumeration can free the page while a reference to it is still held. The vendor-approved CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is local, requires no authentication, and mandates user interaction - the victim must open the file - while our independent assessment scores the demonstrated impact as availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), i.e. a denial-of-service/crash rather than demonstrated code execution. Exposure depends on PDF JavaScript being enabled in the reader, a common default but a configurable setting; no public exploit code has been identified and the issue has not been added to CISA KEV, so this is not confirmed active exploitation.
Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader allows a local attacker to crash the application and potentially expose adjacent memory contents by delivering a specially crafted PDF containing malicious JavaScript. The JavaScript manipulates page and document objects to desynchronize internal page-related state from the renderer's trusted page count; when the renderer subsequently accesses page objects using the stale index, it reads beyond valid memory bounds. No public exploit identified at time of analysis and no CISA KEV listing, but the broad affected version ranges across multiple major release branches (13.x, 14.x, and 2026.x) means a large proportion of unpatched Foxit deployments are exposed.
Foxit PDF Reader and PDF Editor crash with potential memory disclosure when processing maliciously crafted PDF documents containing JavaScript that causes reentrancy during page opening or form formatting. The reentrancy leaves the document object in an inconsistent state; when the application subsequently attempts to dereference stale page metadata, it reads from an invalid memory address (CWE-125 out-of-bounds read), resulting in application termination and limited memory content exposure. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a local user interaction to open a crafted PDF file.
Out-of-bounds read in Foxit PDF Reader and PDF Editor allows a local attacker to crash the application and potentially disclose limited memory contents by delivering a specially crafted PDF containing a malformed image object. The vulnerability triggers when the renderer encounters an abnormal image object, causes it to enter an incorrect processing branch, and subsequently dereferences an invalid buffer pointer during scan line conversion. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS availability impact is rated High, meaning successful exploitation reliably causes application termination.
Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader crashes the application and exposes limited memory contents when a victim opens a specially crafted PDF embedding a semantically malformed color space function. Affected versions span multiple branches across both Editor and Reader products, confirmed through EUVD-2026-42198. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and file-based delivery mechanism make this a plausible phishing lure in targeted campaigns against organizations relying on Foxit products.
XXE injection in Foxit PDF Editor and Foxit PDF Reader exposes any local file readable by the victim user when they open a maliciously crafted document disguised as a PDF. The parser processes documents that are not structurally valid PDFs, resolving attacker-controlled external XML entities that reference local filesystem paths via file:// or similar protocols, enabling out-of-band exfiltration of sensitive local files. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by user interaction (UI:R), limiting opportunistic mass exploitation.
Out-of-bounds read in Foxit PDF Editor and PDF Reader during PRC (Product Representation Compact) 3D content parsing crashes the application and leaks limited memory content. Affects multiple concurrent release trains including versions 2026.1.1, 14.0.4, and 13.2.4 and earlier. Exploitation requires a victim to open a specially crafted PDF containing a malicious PRC entity - no public exploit has been identified at time of analysis.
Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader's PRC 3D file header parser crashes the application and may leak process memory when a victim opens a specially crafted PDF. Affected version ranges span Foxit PDF Reader through 2026.1.1 and multiple Foxit PDF Editor release branches through 13.2.4, 14.0.4, and 2026.1.1. No public exploit code or confirmed active exploitation has been identified at time of analysis; the CVSS availability impact is rated High due to a reliable application crash on trigger, with a minor confidentiality component from out-of-bounds memory exposure.
Unhandled exception in Foxit PDF Editor and Foxit PDF Reader allows local denial of service when a user opens a maliciously crafted PDF file with insufficient parameter verification, causing the application to crash via an uncaught std::invalid_argument exception. The vulnerability requires user interaction (opening a file) and local file access but affects all versions of both products without authentication requirements.
Modal dialog reentry vulnerability in Foxit PDF Editor and Reader allows local attackers to trigger UI freeze and denial of service by supplying a crafted PDF document with a malicious action chain, requiring user interaction to open the file. The vulnerability stems from improper control flow management in document action handling and results in application unresponsiveness on the main thread. No public exploit code or active exploitation has been identified at the time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free vulnerability in Foxit PDF Editor and PDF Reader allows local attackers to crash the application by manipulating document page lifecycle events, causing internal component states to desynchronize and subsequent operations to reference invalidated memory objects. Attack requires user interaction to open a malicious PDF file and does not enable information disclosure or code execution; impact is denial of service with CVSS 5.5 (medium severity). No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application or execute arbitrary code by opening a crafted XFA PDF file during calculate event processing. The vulnerability requires user interaction (opening a malicious PDF) but impacts both products across all versions listed in CPE data. No public exploit code or active exploitation has been confirmed at this time.
Foxit PDF Editor allows PDF JavaScript and document actions (WillPrint/DidPrint) to modify form fields, annotations, and optional content groups immediately before or after redaction, encryption, or printing, potentially causing sensitive content to remain visible or unencrypted despite user expectations. The vulnerability affects all versions of Foxit PDF Editor and requires local access with user interaction (opening a malicious PDF). CVSS score is 4.7 with high confidentiality impact; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Denial of service in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application by opening a crafted PDF containing a stamp annotation with missing appearance (AP) data. The vulnerability stems from insufficient validation before dereferencing annotation objects, triggering a null pointer exception. No public exploit code has been identified, and patch availability has not been confirmed from available advisory data.
Foxit PDF Editor and PDF Reader are vulnerable to denial of service via uncontrolled recursion in maliciously crafted PDF documents containing cyclic object references in pages and annotations. When such documents are processed by APIs performing deep object traversal (such as SOAP handlers), the applications exhaust stack memory and crash. The vulnerability requires only local access and no user interaction beyond opening a malicious PDF, making it a practical attack vector for local denial of service.
Use-after-free in Foxit PDF Editor and Foxit PDF Reader allows local attackers to achieve arbitrary code execution by crafting malicious JavaScript that manipulates document zoom and page state, causing stale view cache pointers to be dereferenced after the underlying view object is destroyed. The vulnerability requires user interaction (opening a crafted PDF) and local access, with a CVSS score of 5.5 reflecting denial-of-service impact, though the underlying memory corruption (CWE-416) and RCE tags indicate higher real-world severity under exploitation.