Description
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

Foxit PDF Editor and Reader contain a use‑after‑free flaw in the processing of malformed PDF form fields. During field‑name traversal, improper validation allows the application to access a released object, which can trigger a crash and may reveal sensitive data contained in the memory region that was freed. The vulnerability is classified as a CWE‑416 defect.

Affected Systems

Affected products include Foxit PDF Editor and Foxit PDF Reader, both produced by Foxit Software Inc. No specific version ranges are indicated in the data, so any installation of these products that has not been updated with Foxit’s latest security patch may be susceptible.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to involve a maliciously crafted PDF file; an attacker who can supply a PDF to a user of the software can trigger the flaw by opening the document.

Generated by OpenCVE AI on September 23, 2026 at 14:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for Foxit PDF Editor or Foxit PDF Reader provided by Foxit Software Inc.
  • Ensure that only trusted PDFs are opened by configuring user access controls or disabling automatic PDF opening features.
  • Use an external scanner or sandbox environment to validate PDFs before opening them in the editor or reader.

Generated by OpenCVE AI on September 23, 2026 at 14:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows
CPEs cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Foxit
Foxit pdf Editor
Foxit pdf Reader
Microsoft
Microsoft windows

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 23 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
Title Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxit Pdf Editor Pdf Reader
Foxitsoftware Foxit Pdf Editor Foxit Reader
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-09-23T15:26:33.453Z

Reserved: 2026-09-15T07:34:45.815Z

Link: CVE-2026-91809

cve-icon Vulnrichment

Updated: 2026-09-23T15:26:30.975Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T08:17:13.070

Modified: 2026-10-08T14:04:38.777

Link: CVE-2026-91809

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:14:41Z

Weaknesses