Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows for potential arbitrary code execution via manipulated document structures.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF software could lead to application crashes or arbitrary code execution when processing malicious PDF documents.

Vulnerability Details

CVE-ID: CVE-2026-5943

Affected Software: Foxit Software Inc. Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor (2026.1 and earlier, 14.0.3 and earlier, 13.2.3 and earlier); Foxit PDF Reader (2026.1 and earlier)

Vulnerability: This is a use-after-free vulnerability (CWE-416) where document structural anomalies cause invalid object references during script-driven modifications, resulting in access to an invalid pointer. The vulnerability requires user interaction, as an attacker must trick a user into opening a specially crafted PDF file.

Business Impact

The CVSS score of 7.8 (High) reflects the potential for total loss of confidentiality, integrity, and availability if an attacker achieves code execution. Successful exploitation could lead to unauthorized system access, data theft, or the installation of malware on victim workstations, posing a significant risk to organizational endpoint security.

Remediation Plan

Immediate Action: Consult the official Foxit Security Bulletins for the release of patches and apply all available security updates to the affected PDF Editor and Reader installations immediately.

Proactive Monitoring: Monitor endpoint logs for abnormal application termination events or unexpected process crashes that may indicate an exploitation attempt.

Compensating Controls: Deploy endpoint protection solutions that can detect and block the execution of malicious scripts embedded within PDF documents to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for memory corruption leading to code execution, though it is mitigated by the requirement for user interaction.

Analyst Recommendation

Given the severity of the vulnerability, organizations should prioritize the deployment of vendor-supplied patches across all managed endpoints. Until updates are applied, users should be cautioned against opening suspicious or unsolicited PDF files, as the attack vector relies on user-initiated document processing.

Description Summary:
Parsing logic flaws in Foxit PDF Editor and Reader allow for invalid memory writes and program crashes when processing malformed form field hierarchies.

Executive Summary:
A critical memory corruption vulnerability in Foxit PDF Editor and Reader allows for potential arbitrary code execution or system instability when processing malicious documents.

Vulnerability Details

CVE-ID: CVE-2026-5941

Affected Software: Foxit Software Inc. Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: Versions 2026.1 and earlier, 14.0.3 and earlier; Foxit PDF Reader: Versions 2026.1 and earlier

Vulnerability: The software contains a flaw in its parsing logic regarding form field hierarchies, which can be triggered by an attacker to cause invalid memory writes. This vulnerability requires user interaction, such as opening a specially crafted PDF file, and does not require prior authentication.

Business Impact

The ability to trigger invalid memory writes poses a significant risk of arbitrary code execution, which could result in a full compromise of the local workstation or server. Given the CVSS score of 7.8, this vulnerability is classified as High, reflecting the potential for complete loss of confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Users should update their Foxit PDF software to the latest versions as soon as they are made available by the vendor to resolve the identified parsing flaws.

Proactive Monitoring: Security teams should monitor endpoint logs for unexpected crashes or error reports associated with the Foxit PDF application processes.

Compensating Controls: Deploy endpoint protection solutions to detect and block the execution of malicious PDF files and restrict the ability of PDF readers to execute arbitrary scripts or system commands.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for memory corruption, but current data suggests that exploitation remains theoretical.

Analyst Recommendation

This vulnerability presents a significant risk to organizational endpoints due to the potential for memory corruption and subsequent system compromise. Administrators must prioritize patching these versions immediately upon the release of security updates from Foxit to prevent potential exploitation.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to trigger program crashes by accessing invalidated objects during UI refreshes.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader may allow an attacker to cause application crashes or potentially lead to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-5940

Affected Software: Foxit Software Inc. Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1 and earlier, 14.0.3 and earlier, 13.2.3 and earlier; Foxit PDF Reader: 2026.1 and earlier

Vulnerability: This is a use-after-free vulnerability (CWE-416) triggered when a function initiates a UI refresh following the removal of comments via script. The vulnerability requires user interaction, specifically the opening of a malicious file, and can be triggered by an unauthenticated local user.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation could result in a total compromise of the application, leading to significant system instability and potential execution of unauthorized code on the host machine. This poses a serious threat to data integrity and system availability for organizations relying on Foxit software for document processing.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Foxit PDF Reader to the latest patched versions provided by Foxit Software Inc. as outlined in their official security bulletins.

Proactive Monitoring: Monitor system logs for unusual application crashes or unexpected behavior in PDF processing workflows that may indicate exploitation attempts.

Compensating Controls: Implement endpoint protection solutions and ensure that users operate with the principle of least privilege to limit the impact of potential application-level compromises.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While use-after-free flaws are inherently dangerous, the requirement for user interaction provides a necessary, though not sufficient, barrier against automated mass exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of use-after-free vulnerabilities, immediate patching is essential to prevent potential code execution scenarios. IT administrators should prioritize updating all instances of Foxit PDF Editor and Reader within their environment to the latest versions to eliminate the underlying memory management defect.

Description Summary:
A Server-Side Request Forgery vulnerability in Foxit PDF Services API allows authenticated attackers to force the server to initiate unauthorized HTTP requests to arbitrary internal or external destinations.

Executive Summary:
The Foxit PDF Services API is vulnerable to a Server-Side Request Forgery flaw that enables attackers to probe internal network infrastructure and bypass access controls.

Vulnerability Details

CVE-ID: CVE-2026-5936

Affected Software: Foxit Software Inc. Foxit PDF Services API

Affected Versions: before 2026-04-07

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability where an authenticated attacker can manipulate server-side HTTP requests by providing a malicious URL. The application fails to properly validate the destination, allowing the server to act as a proxy for unauthorized requests.

Business Impact

This vulnerability poses a significant risk to internal network security. By exploiting this flaw, an attacker could probe private network services, access cloud metadata endpoints, or bypass perimeter firewalls, leading to potential data exfiltration or escalation of privilege within the internal environment. With a CVSS score of 8.5, this high-severity vulnerability requires immediate attention to prevent unauthorized access to sensitive internal resources.

Remediation Plan

Immediate Action: Update the Foxit PDF Services API to the version released on or after 2026-04-07 as specified in the official vendor security bulletin.

Proactive Monitoring: Review web server and application logs for anomalous outbound HTTP requests or patterns indicative of scanning behavior directed at internal IP addresses.

Compensating Controls: Implement strict egress filtering on the server hosting the API to restrict outbound connections to only necessary and trusted external endpoints.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for bypassing network segmentation, which makes it a high priority for remediation despite the lack of confirmed exploitation.

Analyst Recommendation

The risk associated with this SSRF vulnerability is substantial given the potential for lateral movement within the network. Security administrators should prioritize the application of the vendor-provided security update immediately. If patching cannot be performed instantly, ensure that restrictive egress rules are in place to prevent the application from making arbitrary requests to sensitive internal infrastructure.

Description Summary:
An out-of-bounds write vulnerability exists in Foxit PDF Editor and Reader when processing specially crafted Unity 3D objects, potentially allowing for arbitrary code execution.

Executive Summary:
A critical out-of-bounds write vulnerability in Foxit PDF Editor and Reader could allow an attacker to achieve arbitrary code execution via a malicious PDF file.

Vulnerability Details

CVE-ID: CVE-2026-57260

Affected Software: Foxit Software Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application is susceptible to an out-of-bounds write (CWE-787) when parsing malformed Unity 3D objects. Exploitation requires user interaction, such as opening a specially crafted PDF file, and does not require prior authentication.

Business Impact

Successful exploitation of this vulnerability could lead to a full system compromise, including unauthorized data access and the execution of arbitrary code with the privileges of the logged-in user. Given the CVSS score of 7.8, this represents a significant risk to organizational endpoints, particularly if the application is used to process untrusted documents regularly.

Remediation Plan

Immediate Action: Review the official Foxit security bulletin and apply the latest available patches or version upgrades provided by the vendor.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by the PDF application and implement application control policies to restrict document processing.

Compensating Controls: Use Group Policy or endpoint security software to disable 3D object rendering features within PDF viewers if they are not required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a substantial risk to user workstations by enabling potential remote code execution through document manipulation. Organizations should prioritize patching all instances of Foxit PDF Editor and Reader across the enterprise to mitigate the risk of exploitation.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader occurs when executing JavaScript that performs abnormal operations on list box fields, potentially leading to arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to execute arbitrary code or cause application crashes through malicious JavaScript in a PDF form.

Vulnerability Details

CVE-ID: CVE-2026-57256

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier, 14.0.3 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) involves improper handling of list box objects during JavaScript execution, specifically when forms are reset. An attacker can leverage this memory corruption to gain unauthorized control over the application process.

Business Impact

With a CVSS score of 7.8, this flaw poses a significant risk to organizational assets. Exploitation can lead to the exfiltration of sensitive information contained within PDF documents or the compromise of the user's host machine, resulting in potential data breaches and loss of productivity.

Remediation Plan

Immediate Action: Apply the latest security patches released by Foxit for both PDF Editor and PDF Reader to address the list box handling flaw.

Proactive Monitoring: Review application crash logs for patterns involving PDF form interaction or JavaScript execution failures.

Compensating Controls: Restrict the opening of untrusted PDF files from unknown sources and enforce organizational policies that disable JavaScript in PDF viewers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority due to the risk of code execution. Ensure all endpoints with Foxit software are updated to the latest secure version and verify that automatic updates are enabled.

Description Summary:
A type confusion vulnerability in Foxit PDF Editor and Reader exists when processing abnormal annotations, potentially allowing an attacker to execute arbitrary code.

Executive Summary:
A critical type confusion vulnerability in Foxit PDF products could enable an attacker to execute arbitrary code through the use of specifically crafted, abnormal PDF annotations.

Vulnerability Details

CVE-ID: CVE-2026-57254

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-843) involves a type confusion error where the software processes an abnormal annotation that is incorrectly referenced by other objects within the PDF structure. This allows an unauthenticated attacker to manipulate resource access, leading to potential code execution.

Business Impact

The ability to perform type confusion can lead to complete system compromise or unauthorized access to sensitive information. With a CVSS score of 7.8, this vulnerability represents a significant risk to the security posture of any organization relying on Foxit products for document management.

Remediation Plan

Immediate Action: Update all instances of Foxit PDF Editor and Reader to the version recommended by the vendor's security bulletin.

Proactive Monitoring: Monitor for unexpected application behavior or errors when rendering complex or annotated PDF documents.

Compensating Controls: Employ application sandboxing or virtualization to isolate the PDF reader process from the underlying operating system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Type confusion vulnerabilities are often leveraged for reliable exploit chain development. It is imperative that security teams track the release of patches for these versions and deploy them immediately to neutralize the risk.

Description Summary:
A use-after-free vulnerability exists in Foxit PDF Editor and Reader, where processing malicious JavaScript while deleting pages and annotations leads to an application crash or potential code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to trigger a crash or potentially execute arbitrary code via a specially crafted PDF file.

Vulnerability Details

CVE-ID: CVE-2026-57252

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a use-after-free (CWE-416) vulnerability triggered when the application's JavaScript engine handles specific page deletions and annotation removals, causing the attachment panel to access invalid memory pointers. Exploitation requires user interaction to open a malicious document.

Business Impact

The CVSS score of 7.8 (High) reflects the potential for full compromise of confidentiality, integrity, and availability if the use-after-free condition is leveraged for arbitrary code execution. Successful exploitation could lead to unauthorized access to sensitive documents, installation of malware, or complete system instability, disrupting business operations.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest versions provided by the vendor to resolve the memory management flaw.

Proactive Monitoring: Monitor endpoint logs for abnormal application termination events or unexpected process behavior associated with PDF document processing.

Compensating Controls: Disable JavaScript execution within PDF reader settings if such functionality is not required for daily business tasks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of use-after-free vulnerabilities, organizations should prioritize patching affected Foxit installations. Administrators are encouraged to verify the vendor’s security bulletin for specific version releases and deploy updates across the enterprise immediately.

Description Summary:
An improper array index validation vulnerability in Foxit PDF Editor and Reader allows attackers to trigger memory corruption via a malicious PDF with improper cloud-like construction parameters.

Executive Summary:
An improper input validation vulnerability in Foxit PDF software may allow an attacker to cause memory corruption and potential code execution by crafting a malicious PDF file.

Vulnerability Details

CVE-ID: CVE-2026-57251

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-129) occurs because the application fails to enforce upper limits and consistency checks during the construction process of cloud-like annotations in a PDF. An unauthenticated attacker can exploit this by enticing a user to open a specially crafted document.

Business Impact

Exploitation of this vulnerability could lead to arbitrary code execution or a denial-of-service state. Given the CVSS score of 7.8, this poses a high risk to business operations, as successful exploitation could compromise workstation security and sensitive data accessible to the user.

Remediation Plan

Immediate Action: Apply the latest security updates released by Foxit to patch this index validation flaw.

Proactive Monitoring: Review security logs for anomalous application behavior or frequent crashes occurring when users open PDF files.

Compensating Controls: Utilize endpoint security software to block the execution of suspicious files and enforce the use of protected view modes for untrusted PDFs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the need for strict input validation in document processing software. Organizations should ensure that all Foxit software installations are updated to the latest secure versions to prevent potential exploitation.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader exists when resetting form fields via JavaScript, potentially leading to arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader could allow an attacker to achieve code execution by manipulating form field resets.

Vulnerability Details

CVE-ID: CVE-2026-57250

Affected Software: Foxit PDF Editor and Reader

Affected Versions: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application fails to properly manage memory when JavaScript re-enters an interface while resetting form fields. This results in a use-after-free condition (CWE-416), where the application attempts to access memory that has already been deallocated.

Business Impact

The CVSS score of 7.8 highlights the severity of this flaw. Exploitation can lead to arbitrary code execution, which could be used to install malware, exfiltrate sensitive documents, or pivot within the internal network from the compromised endpoint.

Remediation Plan

Immediate Action: Update all instances of Foxit PDF Editor and Reader to the latest vendor-provided versions to patch this memory corruption vulnerability.

Proactive Monitoring: Monitor for unexpected application crashes which are common precursors to successful use-after-free exploitation.

Compensating Controls: Use Group Policy or configuration management to disable JavaScript in PDF readers where it is not strictly required for business workflows.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Use-after-free vulnerabilities are frequent targets for exploit developers due to their reliability in achieving code execution. It is imperative that security teams apply the available patches immediately to prevent potential exploitation of this memory management error.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to execute arbitrary code via a malicious PDF file that resets annotation status and triggers a form reset event.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF software could allow a remote attacker to achieve arbitrary code execution through a specially crafted PDF document.

Vulnerability Details

CVE-ID: CVE-2026-57249

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) involves a use-after-free condition triggered when the application processes a PDF that resets annotation status and subsequently invokes a form reset event. The attack requires user interaction, such as opening a malicious file, and does not require prior authentication.

Business Impact

Successful exploitation allows an attacker to gain control over the affected system, potentially leading to unauthorized data access, malware installation, or system compromise. With a CVSS score of 7.8, this flaw represents a significant risk to organizational endpoints, particularly in environments where users frequently interact with untrusted PDF documents.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest versions provided by the vendor as soon as they become available.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unexpected child processes spawned by the PDF reader.

Compensating Controls: Deploy endpoint protection solutions capable of detecting memory corruption patterns and restrict user permissions to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for arbitrary code execution, this vulnerability poses a high risk to the integrity and security of workstations. Administrators must prioritize patching these versions across all managed endpoints to mitigate the threat of memory corruption attacks.

Description Summary:
A memory management vulnerability in Foxit PDF Editor and Reader allows for potential arbitrary code execution when processing malicious PDF files containing specifically crafted annotation attributes.

Executive Summary:
A high-severity memory management flaw in Foxit PDF Editor and Reader could allow attackers to execute arbitrary code through specially crafted PDF files.

Vulnerability Details

CVE-ID: CVE-2026-57248

Affected Software: Foxit PDF Editor and Reader

Affected Versions: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application lacks sufficient object type and argument checking when JavaScript writes annotation attributes. This leads to the release of an invalid pointer or reference (CWE-763), which can be manipulated by an attacker to trigger memory corruption.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to organizational assets. Successful exploitation allows an attacker to gain control over the application's memory space, potentially leading to unauthorized data access or total system compromise.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit to address the identified memory management flaws.

Proactive Monitoring: Review security logs for suspicious PDF file activity or unusual application behavior that may indicate memory exploitation attempts.

Compensating Controls: Deploy endpoint protection solutions capable of detecting buffer overflows or memory-based attacks, and enforce strict application controls for untrusted PDF documents.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on user interaction for exploitation does not diminish the severity of this vulnerability. Organizations should treat this as a high-priority update to ensure that memory safety mechanisms are properly implemented within the PDF rendering engine.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader occurs when the software incorrectly processes document fields after a page deletion, leading to an illegal memory read.

Executive Summary:
An illegal memory read vulnerability in Foxit PDF Editor and Reader, resulting from improper field processing, may allow an attacker to crash the application or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-57247

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) is triggered when the application re-enters document structures during field processing and attempts to access objects that were previously deleted. An unauthenticated attacker can exploit this by providing a malicious PDF document designed to trigger this specific lifecycle error.

Business Impact

This vulnerability presents a high risk to business operations, as it can lead to application crashes (denial of service) or potential remote code execution. With a CVSS score of 7.8, the impact on workstations—where these products are primarily deployed—is significant, necessitating prompt remediation to prevent compromise.

Remediation Plan

Immediate Action: Update to the most recent version of Foxit PDF Editor or Reader as specified in the official vendor security bulletin.

Proactive Monitoring: Monitor for application crashes or logs indicating illegal read operations within the PDF processing component.

Compensating Controls: Ensure that endpoint protection software is configured to detect and prevent memory-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The complexity of the document structure processing makes this a sensitive area for security. Administrators must prioritize the deployment of vendor-supplied patches to eliminate this use-after-free risk and maintain the security posture of their environments.

Description Summary:
A buffer handling vulnerability in Foxit PDF Editor and Reader allows for application crashes and potential code execution via abnormally constructed objects and JavaScript triggers.

Executive Summary:
A critical vulnerability in Foxit PDF Editor and Reader caused by improper input validation during signature verification could allow an attacker to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-57246

Affected Software: Foxit PDF Editor and Reader

Affected Versions: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application fails to perform adequate argument validation when processing abnormally constructed objects. An attacker can leverage JavaScript to trigger signature verification, where the plugin fails to validate string copying, resulting in a buffer copy error (CWE-120).

Business Impact

The CVSS score of 7.8 (High) reflects the potential for complete impact on confidentiality, integrity, and availability. Successful exploitation requires user interaction but could lead to unauthorized code execution, resulting in full system compromise, data theft, or service disruption for the affected workstation.

Remediation Plan

Immediate Action: Update to the latest version of Foxit PDF Editor or Reader as provided by the vendor’s official security bulletin.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unauthorized attempts to execute scripts within PDF documents.

Compensating Controls: Disable JavaScript in PDF settings across the enterprise to prevent the triggering of automated malicious scripts until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this buffer-related vulnerability, administrators should prioritize the deployment of vendor-supplied updates. If an immediate update is not feasible, restricting the execution of JavaScript in PDF documents is strongly recommended to reduce the attack surface.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader arises from improper validation of annotation relationships and field combinations during hyperlink processing.

Executive Summary:
Failure to validate annotation relationships in Foxit PDF Editor and Reader creates a use-after-free vulnerability that could facilitate unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-57245

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The vulnerability involves a flaw in how the application handles annotation elements related to hyperlinks. An unauthenticated attacker can exploit this via a crafted PDF that triggers an invalid memory operation during the parsing of complex field combinations.

Business Impact

The exploitation of this flaw poses a severe risk to organizational security, as it allows for memory corruption that can be leveraged for code execution. Given the CVSS score of 7.8, this issue presents a high risk of system compromise and potential lateral movement if the affected workstation is integrated into a corporate network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit to resolve the memory validation errors in the annotation processing engine.

Proactive Monitoring: Review security logs for instances of PDF reader instability or unauthorized memory access violations on endpoints.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to detect and block suspicious exploit attempts involving document parsing.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is necessary to mitigate this high-risk vulnerability. Security teams should ensure that all instances of Foxit PDF software are updated to versions that explicitly address these memory safety concerns.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor/Reader occurs due to a lack of re-entry protection and object verification during form synchronization, leading to control pointer failure.

Executive Summary:
A critical use-after-free flaw in Foxit PDF software, caused by improper form synchronization, exposes users to potential arbitrary code execution if they open a malicious PDF.

Vulnerability Details

CVE-ID: CVE-2026-57244

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) arises because the form synchronization process fails to implement re-entry protection or verify object lifecycles after a JavaScript reset. This leads to the failure of control pointers during traversal, which an attacker can exploit to gain control over the application's execution flow.

Business Impact

The CVSS score of 7.8 highlights the high risk of this vulnerability, which could result in severe operational disruption or data breaches. Successful exploitation allows an attacker to bypass security controls and execute arbitrary code, threatening the confidentiality and integrity of the local system.

Remediation Plan

Immediate Action: Update all affected Foxit PDF Editor and Reader software to the latest version immediately upon release of the vendor patch.

Proactive Monitoring: Monitor host-based security systems for suspicious behaviors, such as unexpected memory access patterns, when users interact with PDF files.

Compensating Controls: Leverage endpoint protection platforms (EPP) and Web Application Firewalls (WAF) to detect and block malicious PDF payloads before they reach the endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a serious security weakness that requires immediate attention. Organizations must prioritize the patch deployment process and ensure that all users are running the most secure, updated versions of the Foxit software to prevent potential exploitation.

Description Summary:
A use-after-free vulnerability exists in Foxit PDF Editor and Reader where JavaScript-driven form modifications can lead to memory corruption and potential system instability.

Executive Summary:
A high-severity memory corruption vulnerability in Foxit PDF software allows for potential arbitrary code execution when processing specially crafted PDF forms containing JavaScript.

Vulnerability Details

CVE-ID: CVE-2026-57242

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application is susceptible to a use-after-free (CWE-416) condition when JavaScript modifies a PDF form. This flaw permits an attacker to influence memory state, which can be leveraged for code execution if the user is induced to open a malicious document.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a severe threat to business continuity and data security. Exploitation could allow an attacker to execute commands with the privileges of the logged-in user, potentially leading to unauthorized access to sensitive files or lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit to all affected installations of PDF Editor and Reader.

Proactive Monitoring: Review endpoint security logs for signs of anomalous memory usage or unauthorized process spawning linked to the PDF reader.

Compensating Controls: Utilize security software to enforce restrictive policies on PDF viewer settings, specifically disabling JavaScript execution where business requirements allow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk associated with this vulnerability is significant, as it provides a path for remote code execution. Security teams must ensure that all instances of Foxit PDF software are updated immediately upon the availability of a patch to neutralize this attack vector.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor/Reader occurs when JavaScript deletes PDF fields, leading to invalid pointer references and potential application crashes or arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to trigger invalid pointer references through malicious JavaScript, risking arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-57240

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a Use-After-Free (CWE-416) vulnerability triggered when the application processes a PDF containing JavaScript that deletes form fields. The application fails to update pointers correctly, allowing an attacker to manipulate memory, which typically requires user interaction to open the malicious file.

Business Impact

The CVSS score of 7.8 (High) reflects the significant risk posed by this vulnerability. Successful exploitation could lead to total system compromise, unauthorized data access, or denial-of-service, directly impacting the integrity and availability of workstations handling sensitive PDF documentation.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest available versions provided by the vendor as soon as they are released.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unexpected child processes originating from the PDF reader environment.

Compensating Controls: Implement organizational policies to restrict the execution of JavaScript within PDF viewers and utilize endpoint security solutions to block suspicious file execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the potential for arbitrary code execution, this vulnerability poses a substantial risk to organizational assets. Administrators should prioritize deploying vendor-supplied patches as soon as they become available to mitigate the risk of memory corruption-based attacks.

Description Summary:
Foxit PDF Editor and Reader contain an uncontrolled search path vulnerability that allows low-privileged users to achieve system-level code execution.

Executive Summary:
A privilege escalation vulnerability in Foxit PDF Editor and Reader allows local attackers to achieve NT AUTHORITY\SYSTEM access by exploiting uncontrolled search path elements.

Vulnerability Details

CVE-ID: CVE-2026-57239

Affected Software: Foxit PDF Editor and Reader

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an uncontrolled search path element vulnerability (CWE-427) where user-controlled executable files are executed by high-privilege system processes. By placing a malicious file in a specific location, a low-privileged user can force the application to execute the malicious payload with system-level privileges.

Business Impact

The ability to escalate privileges to NT AUTHORITY\SYSTEM is a critical security event, as it grants the attacker complete control over the local machine. With a CVSS score of 8.2, this vulnerability allows for total compromise of the affected host, including the theft of credentials, data exfiltration, and the installation of persistent malware.

Remediation Plan

Immediate Action: Consult the official Foxit security bulletin to identify the specific patched versions and apply the updates immediately.

Proactive Monitoring: Monitor endpoints for the creation of unexpected executable files in application directories or suspicious child processes spawned by Foxit applications.

Compensating Controls: Deploy endpoint security solutions that can detect and block unauthorized privilege escalation attempts or the execution of unsigned binaries from application-specific directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability allows for full system compromise, it should be treated with the highest priority. Administrators should audit their environments for vulnerable versions of Foxit PDF Editor and Reader and ensure that all instances are updated to the secure versions recommended by the vendor.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader permits arbitrary code execution when JavaScript performs invalid operations on deleted form field objects.

Executive Summary:
A critical use-after-free vulnerability in Foxit software enables potential system exploitation via malicious PDF files that manipulate form field object lifecycles.

Vulnerability Details

CVE-ID: CVE-2026-57238

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a Use-After-Free (CWE-416) vulnerability triggered when JavaScript deletes a form field object while the application continues to reference it. This memory management error can be leveraged by attackers to execute malicious code on the host machine.

Business Impact

The CVSS score of 7.8 highlights the high risk associated with this vulnerability. Exploitation can lead to the unauthorized execution of code, which may result in data exfiltration, system instability, or the deployment of ransomware within the enterprise environment.

Remediation Plan

Immediate Action: Upgrade to the most recent version of the software provided by the vendor to address the memory management flaw.

Proactive Monitoring: Implement robust logging on endpoints to identify unexpected application behavior or memory access violations.

Compensating Controls: Apply organizational policies that restrict the execution of JavaScript in PDF viewers, reducing the attack surface for document-based exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the deployment of vendor-supplied patches to eliminate this use-after-free vulnerability. Given the ease with which such flaws can be weaponized in phishing campaigns, immediate patching is recommended to secure the environment against potential exploitation.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to execute arbitrary code by manipulating form field properties via JavaScript.

Executive Summary:
A high-severity use-after-free flaw in Foxit PDF Editor and Reader poses a significant risk of arbitrary code execution through specially crafted PDF documents.

Vulnerability Details

CVE-ID: CVE-2026-57237

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) occurs when JavaScript modifies form field properties, causing the application to reference invalid memory states. This creates a use-after-free condition that can be exploited by an attacker when a victim opens a malicious PDF.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a significant threat to organizational security. Successful exploitation could lead to full system compromise, enabling attackers to bypass security controls and access sensitive information stored on the affected endpoint.

Remediation Plan

Immediate Action: Apply the latest vendor security patches immediately to all affected systems.

Proactive Monitoring: Review application logs for unusual crashes or errors during PDF processing, as these can serve as indicators of an attempted exploit.

Compensating Controls: Utilize endpoint detection and response (EDR) tools to monitor for unauthorized child processes initiated by the PDF reader application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Prompt remediation is necessary to mitigate the risk of remote code execution. Security teams should verify that all instances of Foxit PDF Editor and Reader are updated to versions released after the patch cycle to ensure the use-after-free condition is fully resolved.

Description Summary:
A local privilege escalation vulnerability exists in the Foxit installer due to an untrusted search path flaw, allowing local attackers to execute malicious binaries with elevated privileges.

Executive Summary:
A local privilege escalation vulnerability in the Foxit PDF Reader and Editor installer allows local attackers to execute arbitrary code with elevated system privileges.

Vulnerability Details

CVE-ID: CVE-2026-3780

Affected Software: Foxit Software Inc. Foxit PDF Reader and Foxit PDF Editor

Affected Versions: Foxit PDF Reader versions 2025.3 and earlier; Foxit PDF Editor versions 2025.3 and earlier, 14.0.2 and earlier

Vulnerability: The application installer utilizes untrusted search paths to resolve system executables and DLLs, which allows a local attacker with standard user privileges to perform binary planting and achieve local privilege escalation.

Business Impact

The vulnerability poses a high risk to organizational security, as it allows a standard local user to escalate their privileges to the level of the installer process. Successful exploitation could lead to full system compromise, unauthorized data access, and the bypass of security controls on affected workstations. The CVSS score of 7.3 reflects the high impact on confidentiality, integrity, and availability for local systems.

Remediation Plan

Immediate Action: Monitor the Foxit security bulletin page for the release of a patched version and apply the update to all affected installations immediately.

Proactive Monitoring: Audit local workstation logs for unauthorized file creation or modifications within application installation directories and monitor for suspicious process execution patterns originating from installer-related paths.

Compensating Controls: Restrict write permissions on directories utilized by installers and ensure that standard users cannot place executable files in locations where the installer might search for dependencies.

Exploitation Status

Public Exploit Available: No — there is no confirmation of a public exploit in the provided data.

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any local user who can write to the search path, making it a significant risk in multi-user environments.

Analyst Recommendation

Given the potential for local privilege escalation, this vulnerability should be treated with high urgency. Organizations should identify all instances of the affected Foxit software within their environment and prepare to deploy the vendor-supplied patch as soon as it becomes available to prevent unauthorized access and potential system-wide compromise.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to achieve arbitrary code execution via crafted documents.

Executive Summary:
A use-after-free vulnerability in Foxit PDF software allows for arbitrary code execution, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-3779

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor 2025.3 and earlier, 14.0.2 and earlier, 13.2.2 and earlier; Foxit PDF Reader 2025.3 and earlier

Vulnerability: This vulnerability involves an improper memory management flaw within the list box calculate array logic. An attacker can trigger a use-after-free condition by providing a specially crafted document, which may lead to arbitrary code execution when the calculation function is executed.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the user running the application. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, data theft, or the installation of persistent malicious software.

Remediation Plan

Immediate Action: Update all installations of Foxit PDF Editor and Foxit PDF Reader to the latest versions provided by the vendor at their official security bulletin site.

Proactive Monitoring: Monitor endpoint logs for suspicious application crashes or unexpected child processes spawned by the PDF reader application.

Compensating Controls: Implement strict email filtering and endpoint protection policies to block or scan suspicious PDF attachments before they reach end users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it requires only user interaction, such as opening a malicious file, to trigger the memory corruption.

Analyst Recommendation

Due to the potential for arbitrary code execution, this vulnerability should be treated with high priority. Organizations using affected versions of Foxit PDF software must apply the latest vendor patches immediately to remediate the underlying memory safety issue and prevent potential exploitation.

Description Summary:
A DLL hijacking vulnerability in the update service of Foxit PDF Editor and Reader allows local users to execute arbitrary code with SYSTEM privileges.

Executive Summary:
A local privilege escalation vulnerability in Foxit PDF Editor and Reader allows attackers to achieve arbitrary code execution with SYSTEM privileges by placing malicious libraries in user-writable directories.

Vulnerability Details

CVE-ID: CVE-2026-3775

Affected Software: Foxit Software Inc. Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Versions 2025.3 and earlier

Vulnerability: The application's update service performs insecure library loading, specifically via DLL hijacking (CWE-427), by searching directories writable by low-privileged users. This allows a local authenticated user to substitute legitimate libraries with malicious ones that execute with elevated SYSTEM privileges.

Business Impact

Successful exploitation of this vulnerability results in a full compromise of the host system, as the attacker gains SYSTEM-level access. This allows for total control over the application environment, potentially leading to data theft, installation of persistent backdoors, and lateral movement within the network. Given the CVSS score of 7.8, this represents a high-severity risk that demands immediate attention to prevent local privilege escalation.

Remediation Plan

Immediate Action: Monitor the official Foxit security bulletin page for the release of a patched version and apply the update to all affected installations immediately upon availability.

Proactive Monitoring: Review system logs for unusual process execution patterns or the loading of unsigned libraries, particularly within the application's update service directories.

Compensating Controls: Restrict write permissions on application directories and system paths to prevent unauthorized users from placing malicious files in locations where they might be loaded by higher-privilege services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any local user with sufficient permissions to write to the targeted search directories.

Analyst Recommendation

This vulnerability presents a significant risk to endpoint integrity due to the potential for privilege escalation to the SYSTEM level. Organizations should prioritize updating all Foxit PDF Editor and Reader instances as soon as the vendor provides a corrective patch. In the interim, ensure that standard user accounts are restricted from modifying files or directories associated with the application update service to limit the attack surface.

Description Summary:
A server-side request forgery vulnerability in the Foxit PDF Services API allows authenticated users to manipulate external file references during PDF creation.

Executive Summary:
A server-side request forgery vulnerability in the Foxit PDF Services API allows authenticated attackers to perform unauthorized requests to external files, potentially exposing sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-18597

Affected Software: Foxit PDF Services API

Affected Versions: Before 2026-07-27

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability. It occurs during the PDF creation process when the service processes external file references, and it requires the attacker to be authenticated.

Business Impact

The vulnerability is rated with a CVSS score of 8.5, reflecting its potential for significant impact on data confidentiality. An authenticated attacker could potentially use this service to force the application to fetch content from unauthorized locations or internal resources, leading to data exfiltration or internal network mapping.

Remediation Plan

Immediate Action: Update the Foxit PDF Services API to the version released on or after 2026-07-27 to address the identified SSRF flaw.

Proactive Monitoring: Audit logs for the PDF conversion service to identify anomalous file reference requests or attempts to access internal URLs.

Compensating Controls: Ensure the application is deployed in an environment with strict egress filtering to limit the destinations the service can communicate with.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is limited by the requirement for authenticated access.

Analyst Recommendation

Organizations should ensure they have updated their Foxit PDF Services API to the July 2026 patch level. Given the nature of SSRF, restricting the server's network access remains a vital defense-in-depth measure.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to execute arbitrary code via a maliciously crafted PDF file using a damaged field tree.

Executive Summary:
A high-severity use-after-free vulnerability in Foxit PDF Editor and Reader could allow an attacker to gain unauthorized control over a user's system.

Vulnerability Details

CVE-ID: CVE-2026-13129

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a Use-After-Free (CWE-416) vulnerability triggered when the application processes a PDF containing a damaged field tree. An attacker can leverage JavaScript to trigger invalid object access, requiring user interaction to open the malicious file.

Business Impact

The CVSS score of 7.8 (High) reflects the potential for complete compromise of system confidentiality, integrity, and availability. Successful exploitation allows remote code execution in the context of the user, which could result in data theft, installation of malware, or lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update to the latest version of Foxit PDF Editor or Reader as specified in the official vendor security bulletin.

Proactive Monitoring: Monitor endpoint logs for suspicious process spawning behavior related to the Foxit application suite.

Compensating Controls: Deploy endpoint protection solutions capable of detecting malicious PDF document patterns and restrict the execution of JavaScript within PDF viewers via Group Policy if business requirements allow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the prevalence of PDF-based attack vectors, organizations should treat this vulnerability with urgency. Prioritize patching all workstations running affected versions of Foxit PDF Editor and Reader to prevent potential arbitrary code execution.

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows for potential code execution when processing PDFs with embedded JavaScript.

Executive Summary:
A high-severity use-after-free flaw in Foxit PDF Editor and Reader can be exploited by an attacker to execute arbitrary code through a maliciously crafted PDF file.

Vulnerability Details

CVE-ID: CVE-2026-13128

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor (2026.1.1 and earlier), Foxit PDF Reader (2026.1.1 and earlier)

Vulnerability: The application is vulnerable to a use-after-free (CWE-416) condition when handling embedded JavaScript that triggers page deletion. Exploitation requires a user to open a malicious PDF, which then leads to invalid object memory handling.

Business Impact

The CVSS score of 7.8 indicates a high risk of compromise for affected endpoints. Successful exploitation allows an attacker to execute arbitrary code, potentially leading to the exfiltration of sensitive information or the deployment of ransomware within the enterprise environment.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit for both PDF Editor and Reader.

Proactive Monitoring: Review enterprise security logs for suspicious file execution patterns associated with PDF reader applications.

Compensating Controls: Implement organizational policies to disable JavaScript in PDF readers and utilize endpoint security solutions to detect and block malicious document execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the prevalence of PDF-based attacks, it is critical to address this vulnerability promptly. Organizations should verify that all instances of Foxit PDF software are updated to the current secure version to protect against potential exploitation.

Description Summary:
A use-after-free vulnerability exists in Foxit PDF Editor and Reader, which may allow an attacker to execute arbitrary code when opening a maliciously crafted PDF file.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader could allow an attacker to achieve code execution through a specially crafted PDF document.

Vulnerability Details

CVE-ID: CVE-2026-13127

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a use-after-free vulnerability (CWE-416) triggered when the application processes a PDF file. The vulnerability requires user interaction to open the malicious file, but once opened, an unauthenticated attacker could potentially gain control of the application process.

Business Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution on the host system, potentially resulting in data exfiltration, unauthorized access to sensitive documents, or complete system compromise. With a CVSS score of 7.8, this vulnerability is classified as High severity, as it poses a significant risk to the integrity and confidentiality of end-user workstations.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest available versions released by the vendor to patch the underlying memory corruption issue.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unexpected child processes spawned by the PDF reader.

Compensating Controls: Restrict the ability of PDF readers to execute scripts or access network resources via endpoint security policies until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of use-after-free vulnerabilities in document processing software, organizations should prioritize deploying the latest vendor updates across all workstations. Users should be advised to exercise caution when opening unsolicited PDF files from untrusted sources.

Description Summary:
Foxit PDF Editor and Reader are susceptible to a use-after-free vulnerability triggered by maliciously crafted JavaScript within a PDF document.

Executive Summary:
A high-severity use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to execute arbitrary code or cause system crashes through malicious PDF documents.

Vulnerability Details

CVE-ID: CVE-2026-13126

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor (2026.1.1 and earlier, 14.0.4 and earlier), Foxit PDF Reader (2026.1.1 and earlier)

Vulnerability: This vulnerability (CWE-416) occurs when embedded JavaScript in a PDF file deletes objects, leading to a use-after-free condition. It requires user interaction, such as opening a specially crafted PDF, to trigger the flaw.

Business Impact

With a CVSS score of 7.8, this flaw poses a substantial risk of remote code execution. A successful exploit could lead to full system compromise, unauthorized data access, and potential malware installation, impacting organizational security posture and data confidentiality.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest patched versions provided by the vendor.

Proactive Monitoring: Monitor endpoint activity for abnormal process behavior or crashes associated with the PDF application.

Compensating Controls: Disable JavaScript execution within PDF reader settings if immediate patching is not feasible, and restrict the opening of untrusted PDF documents.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to end-user workstations. Organizations should mandate the update to the latest version of Foxit software to mitigate the possibility of arbitrary code execution via malicious documents.

Description Summary:
A sandbox bypass vulnerability in Foxit AI allows remote code execution when processing malicious PDF files containing embedded JavaScript.

Executive Summary:
Foxit AI contains a critical remote code execution vulnerability that allows attackers to escape the sandbox via malicious PDF files.

Vulnerability Details

CVE-ID: CVE-2026-12057

Affected Software: Foxit AI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists because the application fails to properly intercept dangerous interfaces when executing embedded JavaScript within a PDF. This failure allows remote scripts to be loaded, resulting in arbitrary code execution within the context of the application.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a major risk. An attacker could exploit this by enticing a user to open a specially crafted PDF document, leading to code execution that could compromise the user's workstation or gain a foothold within the corporate network.

Remediation Plan

Immediate Action: Update Foxit AI software to the latest version as recommended by the Foxit security bulletin.

Proactive Monitoring: Monitor for suspicious PDF activity and utilize endpoint protection solutions to block the execution of unauthorized scripts spawned by document readers.

Compensating Controls: Disable JavaScript execution within PDF readers via group policy or application settings to prevent the exploitation of this and similar vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution vulnerabilities in document readers are highly effective attack vectors. Organizations should deploy the latest patches immediately and consider disabling PDF JavaScript execution as a proactive security measure.

Description Summary:
A heap-based buffer overflow in Foxit PDF Reader and Editor allows remote attackers to execute arbitrary code via specially crafted JBIG2 data.

Executive Summary:
A critical heap-based buffer overflow vulnerability in Foxit PDF Reader and Editor could allow a remote attacker to achieve arbitrary code execution through malicious JBIG2 image processing.

Vulnerability Details

CVE-ID: CVE-2025-66499

Affected Software: Foxit Software Inc. Foxit PDF Reader and Foxit PDF Editor

Affected Versions: Foxit PDF Reader/Editor: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier

Vulnerability: The vulnerability stems from an integer overflow in the calculation of image buffer sizes during JBIG2 data parsing, triggering a heap-based buffer overflow. The attack requires user interaction, such as opening a malicious file, but does not require prior authentication.

Business Impact

The ability for an attacker to execute arbitrary code on a user's machine poses a significant risk to organizational integrity and data confidentiality. Given the CVSS score of 7.8, this vulnerability is classified as High severity, as it could lead to full system compromise, unauthorized access to sensitive documents, or lateral movement within the network.

Remediation Plan

Immediate Action: Users should visit the official Foxit Security Bulletins page to verify the availability of patches for their specific product version and apply updates immediately.

Proactive Monitoring: Security teams should monitor endpoint activity for unusual spawned processes originating from the PDF application, such as command shells or unauthorized network connections.

Compensating Controls: Deploy endpoint protection solutions to detect and block malicious file executions and consider restricting the ability of PDF readers to execute external scripts or connect to the internet where possible.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploitability is currently unconfirmed in the wild, the potential for arbitrary code execution makes this a high-priority item for patching once vendor updates are verified.

Analyst Recommendation

This vulnerability represents a significant risk due to the potential for remote code execution. Administrators should prioritize identifying all instances of Foxit PDF Reader and Editor within the environment and prepare for an urgent deployment of security patches as soon as Foxit releases the relevant updates.

Description Summary:
A use-after-free vulnerability in Foxit PDF Reader and Editor allows remote code execution when a user opens a specially crafted PDF file containing malicious JavaScript.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Reader and Editor allows remote attackers to execute arbitrary code via malicious PDF documents.

Vulnerability Details

CVE-ID: CVE-2025-66495

Affected Software: Foxit Software Inc. Foxit PDF Reader and Foxit PDF Editor

Affected Versions: Foxit PDF Reader and Editor: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier

Vulnerability: This is a use-after-free flaw (CWE-416) occurring within the annotation handling component. An unauthenticated attacker can trigger this vulnerability by enticing a user to open a specially crafted PDF file containing malicious JavaScript, which results in the dereferencing of a freed memory pointer.

Business Impact

The successful exploitation of this vulnerability permits remote code execution on the target system, potentially leading to full system compromise. Given the CVSS score of 7.8, this represents a high-severity risk that could result in significant data exfiltration, unauthorized administrative access, and severe operational disruption for organizations relying on these tools.

Remediation Plan

Immediate Action: Update Foxit PDF Reader and Foxit PDF Editor to versions beyond 2025.2.1, 14.0.1, or 13.2.1 as specified in the official security bulletin.

Proactive Monitoring: Monitor endpoint activity for unusual child processes spawned by the PDF reader application and review workstation logs for signs of anomalous memory access or crashes.

Compensating Controls: Disable JavaScript execution within the Foxit PDF application settings if immediate patching is not feasible, as this serves as the primary vector for exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it relies on common user interaction, specifically opening a malicious document, to initiate the memory corruption sequence.

Analyst Recommendation

This vulnerability poses a significant risk to organizational endpoints due to the potential for remote code execution via common file formats. Security teams should prioritize the deployment of the vendor-provided updates across all managed workstations to eliminate the exposure. Until patches are applied, users should exercise extreme caution when opening unsolicited PDF documents from untrusted sources.

Description Summary:
A use-after-free vulnerability in Foxit PDF Reader and Editor allows remote code execution when parsing maliciously crafted PDF files.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Reader and Editor could allow a remote attacker to achieve arbitrary code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2025-66494

Affected Software: Foxit Software Inc. Foxit PDF Reader and Foxit PDF Editor

Affected Versions: Foxit PDF Reader/Editor: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier

Vulnerability: This is a use-after-free flaw (CWE-416) occurring during PDF file parsing. The issue arises when a PDF object is incorrectly managed by multiple parent objects, leading to a memory corruption state that can be triggered by an unauthenticated attacker via a specially crafted document.

Business Impact

Successful exploitation of this vulnerability allows for remote code execution, which grants an attacker the ability to compromise the integrity, availability, and confidentiality of the affected workstation. Given the CVSS score of 7.8, this poses a significant risk to organizational assets, as it facilitates unauthorized access and potential lateral movement within the network.

Remediation Plan

Immediate Action: Users must update Foxit PDF Reader and Foxit PDF Editor to the latest available versions released after 2025.2.1, 14.0.1, or 13.2.1 to ensure the memory management flaw is patched.

Proactive Monitoring: Security teams should monitor endpoint activity for suspicious processes spawned by the PDF reader application and review system logs for unusual behavior following the opening of untrusted files.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to identify and block shellcode execution attempts originating from PDF software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires user interaction to trigger, typically through the opening of a malicious PDF file.

Analyst Recommendation

This vulnerability represents a significant risk to user workstations due to the potential for remote code execution. It is highly recommended that IT administrators prioritize the deployment of vendor-supplied patches across all instances of Foxit PDF Reader and Editor to eliminate the attack vector.

Description Summary:
A use-after-free vulnerability in Foxit PDF Reader and Editor allows remote code execution when a user opens a malicious PDF containing specially crafted JavaScript.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Reader and Editor allows remote attackers to execute arbitrary code on Windows systems by enticing users to open a malicious PDF.

Vulnerability Details

CVE-ID: CVE-2025-66493

Affected Software: Foxit Software Inc. Foxit PDF Reader and Foxit PDF Editor

Affected Versions: Foxit PDF Editor: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier; Foxit PDF Reader: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier

Vulnerability: This is a use-after-free flaw (CWE-416) within the AcroForm handling engine. The vulnerability is triggered when the software processes specially crafted JavaScript, allowing an attacker to dereference a memory pointer that has already been freed.

Business Impact

The vulnerability poses a severe risk to organizational security, as successful exploitation results in arbitrary code execution on the victim's workstation. Given the CVSS score of 7.8, this flaw represents a high risk to data confidentiality, integrity, and availability, potentially allowing attackers to gain full control over the host system.

Remediation Plan

Immediate Action: Update Foxit PDF Reader and Foxit PDF Editor to the latest available versions provided by the vendor, ensuring all iterations (2025.x, 14.x, and 13.x) are patched beyond the vulnerable versions listed.

Proactive Monitoring: Monitor endpoint execution logs for unusual child processes spawned by Foxit PDF Reader or Editor, such as command shells or unauthorized network connections.

Compensating Controls: Restrict the execution of JavaScript within PDF viewers via Group Policy or administrative settings if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires user interaction, specifically the opening of a malicious file, to trigger the memory corruption.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability should be prioritized for remediation. IT administrators must ensure that all instances of Foxit PDF Reader and Editor are updated immediately, as the exploitation of memory corruption bugs is a common vector for initial access and malware deployment.

Description Summary:
A local privilege escalation vulnerability in the Foxit PDF Reader/Editor Update Service allows low-privileged users to execute arbitrary code with SYSTEM privileges via file permission manipulation.

Executive Summary:
A critical local privilege escalation vulnerability in the Foxit PDF Reader and Editor Update Service allows a low-privileged attacker to gain full SYSTEM control over the affected host.

Vulnerability Details

CVE-ID: CVE-2025-13941

Affected Software: Foxit Software Inc. Foxit PDF Reader and Foxit PDF Editor

Affected Versions: Foxit PDF Reader: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier; Foxit PDF Editor: 2025.2.1 and earlier, 14.0.1 and earlier, 13.2.1 and earlier

Vulnerability: This vulnerability (CWE-732) arises from incorrect file system permissions assigned to resources during plugin installation. A local attacker with low privileges can modify or replace these resources, which the update service subsequently executes with SYSTEM privileges.

Business Impact

The ability for a local user to escalate privileges to the SYSTEM level poses a severe risk to the entire organization. Successful exploitation allows an attacker to bypass all OS security controls, potentially leading to full system compromise, data theft, and the installation of persistent malicious software. With a CVSS score of 8.8, this vulnerability represents a high-severity threat to any environment where these applications are deployed.

Remediation Plan

Immediate Action: Monitor the official Foxit security bulletin page for the release of a patched version and apply the update to all instances of Foxit PDF Reader and Editor across the enterprise immediately.

Proactive Monitoring: Review system logs for unauthorized modifications to installation directories or unexpected executions originating from the Foxit Update Service process.

Compensating Controls: Restrict write permissions on the installation directories for the Foxit update service to administrative users only, preventing non-privileged users from modifying the vulnerable resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited to local users, but the high impact of gaining SYSTEM-level access makes this a priority for internal security teams.

Analyst Recommendation

Given the potential for complete system compromise, this vulnerability must be addressed with high urgency. Administrators should prioritize the deployment of vendor-supplied patches as soon as they become available and implement strict file system controls to restrict access to update service resources in the interim.