Description
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use-After-Free potentially leading to arbitrary code execution
Action: Apply patch
AI Analysis

Impact

Foxit PDF Editor and Reader contain a use‑after‑free flaw in the handling of JavaScript array objects. A specially crafted PDF can trigger the application to access a freed object during array processing, which may cause the program to crash or allow an attacker to run arbitrary code. The weakness corresponds to CWE‑416 and can compromise confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability affects Foxit Software Inc. products – Foxit PDF Editor and Foxit PDF Reader. No specific version range is provided, so all released versions should be examined against the vendor’s security bulletins for a fix.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. EPSS is listed as < 1 %, suggesting a low likelihood of active exploitation at present, and the vulnerability is not in CISA’s KEV catalog. The likely attack vector is a malicious PDF presented to a user; once the user opens the file, the flaw may be triggered, leading to code execution or denial‑of‑service.

Generated by OpenCVE AI on September 23, 2026 at 14:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Foxit PDF Editor/Reader patch available from the security bulletin on foxit.com
  • Disable or restrict JavaScript execution within the PDF viewer where possible; consider using a sandboxed or hardened viewer
  • Implement a policy to block or quarantine unknown or unsigned PDF documents before they reach end users
  • Monitor system logs for crashes or anomalous behavior and investigate promptly

Generated by OpenCVE AI on September 23, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows
CPEs cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.
Title Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxit Pdf Editor Pdf Reader
Foxitsoftware Foxit Pdf Editor Foxit Reader
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-09-23T14:42:34.355Z

Reserved: 2026-09-15T07:34:43.392Z

Link: CVE-2026-91799

cve-icon Vulnrichment

Updated: 2026-09-23T14:42:31.598Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T08:17:11.907

Modified: 2026-10-08T13:50:42.047

Link: CVE-2026-91799

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:12:06Z

Weaknesses