Description
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Foxit PDF Editor and Reader contain a use‑after‑free in the handling of PDF form fields. Embedded JavaScript can reference form‑field memory after those fields have been released, which may cause the application to crash. The vulnerability is classified as a use‑after‑free (CWE‑416).

Affected Systems

Foxit PDF Editor and Foxit PDF Reader provided by Foxit Software Inc. No specific version range is supplied in the advisory. Users should verify which of their current installations are affected and plan for an update.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity impact. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Likely, the attack requires a crafted PDF containing JavaScript to be opened by the victim, a local user or a social‑engineering scenario. If successful, the attacker could cause a crash.

Generated by OpenCVE AI on September 23, 2026 at 15:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest available version of Foxit PDF Editor or Foxit PDF Reader that includes the vendor’s fix for this use‑after‑free flaw.
  • Disable JavaScript execution for PDF documents in the application settings to prevent scripts from accessing form‑field data.
  • Avoid opening PDF files from untrusted or suspicious sources, or use a reader with JavaScript disabled as a temporary workaround.

Generated by OpenCVE AI on September 23, 2026 at 15:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows
CPEs cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.
Title Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxit Pdf Editor Pdf Reader
Foxitsoftware Foxit Pdf Editor Foxit Reader
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-09-23T14:41:45.744Z

Reserved: 2026-09-15T07:34:43.393Z

Link: CVE-2026-91806

cve-icon Vulnrichment

Updated: 2026-09-23T14:41:40.811Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T08:17:12.693

Modified: 2026-10-08T12:24:50.383

Link: CVE-2026-91806

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:12:16Z

Weaknesses