Description
When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use‑After‑Free Crash with potential Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A specially crafted PDF can trigger reentrant zoom and layout operations via page and annotation‑related JavaScript, causing the editor to access a page object after it has been released. This use‑after‑free can crash the application and, if memory is reused, may enable an attacker to execute arbitrary code. The flaw is classified as CWE‑416.

Affected Systems

Foxit PDF Editor and Foxit PDF Reader are affected. Version information is not provided, so all current releases that have the unpatched PDF parsing logic remain susceptible.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. An EPSS score of less than 1 % suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to entice a user to open a malicious PDF, so the threat relies on social engineering or compromised documents, but the potential impact is significant if the flaw is successfully exploited.

Generated by OpenCVE AI on September 23, 2026 at 14:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Foxit PDF Editor/Reader release that addresses the use‑after‑free bug.
  • Disable JavaScript execution in PDF files via the editor’s settings to prevent the trigger actions.
  • Verify the source and integrity of PDF documents, using digital signatures or quarantine unknown files before opening.
  • Consider disabling or limiting reentrant zoom and layout features if the application allows such configuration.

Generated by OpenCVE AI on September 23, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows
CPEs cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.
Title Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxit Pdf Editor Pdf Reader
Foxitsoftware Foxit Pdf Editor Foxit Reader
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-09-23T14:47:31.412Z

Reserved: 2026-09-15T07:34:40.287Z

Link: CVE-2026-91792

cve-icon Vulnrichment

Updated: 2026-09-23T14:47:28.243Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T08:17:11.110

Modified: 2026-10-08T13:20:31.513

Link: CVE-2026-91792

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:11:49Z

Weaknesses