---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier, 14.0.3 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader occurs when executing JavaScript that performs abnormal operations on list box fields, potentially leading to arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to execute arbitrary code or cause application crashes through malicious JavaScript in a PDF form.

Vulnerability Details

CVE-ID: CVE-2026-57256

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier, 14.0.3 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) involves improper handling of list box objects during JavaScript execution, specifically when forms are reset. An attacker can leverage this memory corruption to gain unauthorized control over the application process.

Business Impact

With a CVSS score of 7.8, this flaw poses a significant risk to organizational assets. Exploitation can lead to the exfiltration of sensitive information contained within PDF documents or the compromise of the user's host machine, resulting in potential data breaches and loss of productivity.

Remediation Plan

Immediate Action: Apply the latest security patches released by Foxit for both PDF Editor and PDF Reader to address the list box handling flaw.

Proactive Monitoring: Review application crash logs for patterns involving PDF form interaction or JavaScript execution failures.

Compensating Controls: Restrict the opening of untrusted PDF files from unknown sources and enforce organizational policies that disable JavaScript in PDF viewers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority due to the risk of code execution. Ensure all endpoints with Foxit software are updated to the latest secure version and verify that automatic updates are enabled.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor and Foxit PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A type confusion vulnerability in Foxit PDF Editor and Reader exists when processing abnormal annotations, potentially allowing an attacker to execute arbitrary code.

Executive Summary:
A critical type confusion vulnerability in Foxit PDF products could enable an attacker to execute arbitrary code through the use of specifically crafted, abnormal PDF annotations.

Vulnerability Details

CVE-ID: CVE-2026-57254

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-843) involves a type confusion error where the software processes an abnormal annotation that is incorrectly referenced by other objects within the PDF structure. This allows an unauthenticated attacker to manipulate resource access, leading to potential code execution.

Business Impact

The ability to perform type confusion can lead to complete system compromise or unauthorized access to sensitive information. With a CVSS score of 7.8, this vulnerability represents a significant risk to the security posture of any organization relying on Foxit products for document management.

Remediation Plan

Immediate Action: Update all instances of Foxit PDF Editor and Reader to the version recommended by the vendor's security bulletin.

Proactive Monitoring: Monitor for unexpected application behavior or errors when rendering complex or annotated PDF documents.

Compensating Controls: Employ application sandboxing or virtualization to isolate the PDF reader process from the underlying operating system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Type confusion vulnerabilities are often leveraged for reliable exploit chain development. It is imperative that security teams track the release of patches for these versions and deploy them immediately to neutralize the risk.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in Foxit PDF Editor and Reader, where processing malicious JavaScript while deleting pages and annotations leads to an application crash or potential code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to trigger a crash or potentially execute arbitrary code via a specially crafted PDF file.

Vulnerability Details

CVE-ID: CVE-2026-57252

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a use-after-free (CWE-416) vulnerability triggered when the application's JavaScript engine handles specific page deletions and annotation removals, causing the attachment panel to access invalid memory pointers. Exploitation requires user interaction to open a malicious document.

Business Impact

The CVSS score of 7.8 (High) reflects the potential for full compromise of confidentiality, integrity, and availability if the use-after-free condition is leveraged for arbitrary code execution. Successful exploitation could lead to unauthorized access to sensitive documents, installation of malware, or complete system instability, disrupting business operations.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest versions provided by the vendor to resolve the memory management flaw.

Proactive Monitoring: Monitor endpoint logs for abnormal application termination events or unexpected process behavior associated with PDF document processing.

Compensating Controls: Disable JavaScript execution within PDF reader settings if such functionality is not required for daily business tasks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of use-after-free vulnerabilities, organizations should prioritize patching affected Foxit installations. Administrators are encouraged to verify the vendor’s security bulletin for specific version releases and deploy updates across the enterprise immediately.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor and Foxit PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An improper array index validation vulnerability in Foxit PDF Editor and Reader allows attackers to trigger memory corruption via a malicious PDF with improper cloud-like construction parameters.

Executive Summary:
An improper input validation vulnerability in Foxit PDF software may allow an attacker to cause memory corruption and potential code execution by crafting a malicious PDF file.

Vulnerability Details

CVE-ID: CVE-2026-57251

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-129) occurs because the application fails to enforce upper limits and consistency checks during the construction process of cloud-like annotations in a PDF. An unauthenticated attacker can exploit this by enticing a user to open a specially crafted document.

Business Impact

Exploitation of this vulnerability could lead to arbitrary code execution or a denial-of-service state. Given the CVSS score of 7.8, this poses a high risk to business operations, as successful exploitation could compromise workstation security and sensitive data accessible to the user.

Remediation Plan

Immediate Action: Apply the latest security updates released by Foxit to patch this index validation flaw.

Proactive Monitoring: Review security logs for anomalous application behavior or frequent crashes occurring when users open PDF files.

Compensating Controls: Utilize endpoint security software to block the execution of suspicious files and enforce the use of protected view modes for untrusted PDFs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the need for strict input validation in document processing software. Organizations should ensure that all Foxit software installations are updated to the latest secure versions to prevent potential exploitation.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor and Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader exists when resetting form fields via JavaScript, potentially leading to arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader could allow an attacker to achieve code execution by manipulating form field resets.

Vulnerability Details

CVE-ID: CVE-2026-57250

Affected Software: Foxit PDF Editor and Reader

Affected Versions: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application fails to properly manage memory when JavaScript re-enters an interface while resetting form fields. This results in a use-after-free condition (CWE-416), where the application attempts to access memory that has already been deallocated.

Business Impact

The CVSS score of 7.8 highlights the severity of this flaw. Exploitation can lead to arbitrary code execution, which could be used to install malware, exfiltrate sensitive documents, or pivot within the internal network from the compromised endpoint.

Remediation Plan

Immediate Action: Update all instances of Foxit PDF Editor and Reader to the latest vendor-provided versions to patch this memory corruption vulnerability.

Proactive Monitoring: Monitor for unexpected application crashes which are common precursors to successful use-after-free exploitation.

Compensating Controls: Use Group Policy or configuration management to disable JavaScript in PDF readers where it is not strictly required for business workflows.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Use-after-free vulnerabilities are frequent targets for exploit developers due to their reliability in achieving code execution. It is imperative that security teams apply the available patches immediately to prevent potential exploitation of this memory management error.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor and Foxit PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to execute arbitrary code via a malicious PDF file that resets annotation status and triggers a form reset event.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF software could allow a remote attacker to achieve arbitrary code execution through a specially crafted PDF document.

Vulnerability Details

CVE-ID: CVE-2026-57249

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) involves a use-after-free condition triggered when the application processes a PDF that resets annotation status and subsequently invokes a form reset event. The attack requires user interaction, such as opening a malicious file, and does not require prior authentication.

Business Impact

Successful exploitation allows an attacker to gain control over the affected system, potentially leading to unauthorized data access, malware installation, or system compromise. With a CVSS score of 7.8, this flaw represents a significant risk to organizational endpoints, particularly in environments where users frequently interact with untrusted PDF documents.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest versions provided by the vendor as soon as they become available.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unexpected child processes spawned by the PDF reader.

Compensating Controls: Deploy endpoint protection solutions capable of detecting memory corruption patterns and restrict user permissions to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for arbitrary code execution, this vulnerability poses a high risk to the integrity and security of workstations. Administrators must prioritize patching these versions across all managed endpoints to mitigate the threat of memory corruption attacks.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor and Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A memory management vulnerability in Foxit PDF Editor and Reader allows for potential arbitrary code execution when processing malicious PDF files containing specifically crafted annotation attributes.

Executive Summary:
A high-severity memory management flaw in Foxit PDF Editor and Reader could allow attackers to execute arbitrary code through specially crafted PDF files.

Vulnerability Details

CVE-ID: CVE-2026-57248

Affected Software: Foxit PDF Editor and Reader

Affected Versions: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application lacks sufficient object type and argument checking when JavaScript writes annotation attributes. This leads to the release of an invalid pointer or reference (CWE-763), which can be manipulated by an attacker to trigger memory corruption.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to organizational assets. Successful exploitation allows an attacker to gain control over the application's memory space, potentially leading to unauthorized data access or total system compromise.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit to address the identified memory management flaws.

Proactive Monitoring: Review security logs for suspicious PDF file activity or unusual application behavior that may indicate memory exploitation attempts.

Compensating Controls: Deploy endpoint protection solutions capable of detecting buffer overflows or memory-based attacks, and enforce strict application controls for untrusted PDF documents.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on user interaction for exploitation does not diminish the severity of this vulnerability. Organizations should treat this as a high-priority update to ensure that memory safety mechanisms are properly implemented within the PDF rendering engine.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor / Foxit PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader occurs when the software incorrectly processes document fields after a page deletion, leading to an illegal memory read.

Executive Summary:
An illegal memory read vulnerability in Foxit PDF Editor and Reader, resulting from improper field processing, may allow an attacker to crash the application or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-57247

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) is triggered when the application re-enters document structures during field processing and attempts to access objects that were previously deleted. An unauthenticated attacker can exploit this by providing a malicious PDF document designed to trigger this specific lifecycle error.

Business Impact

This vulnerability presents a high risk to business operations, as it can lead to application crashes (denial of service) or potential remote code execution. With a CVSS score of 7.8, the impact on workstations—where these products are primarily deployed—is significant, necessitating prompt remediation to prevent compromise.

Remediation Plan

Immediate Action: Update to the most recent version of Foxit PDF Editor or Reader as specified in the official vendor security bulletin.

Proactive Monitoring: Monitor for application crashes or logs indicating illegal read operations within the PDF processing component.

Compensating Controls: Ensure that endpoint protection software is configured to detect and prevent memory-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The complexity of the document structure processing makes this a sensitive area for security. Administrators must prioritize the deployment of vendor-supplied patches to eliminate this use-after-free risk and maintain the security posture of their environments.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor and Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A buffer handling vulnerability in Foxit PDF Editor and Reader allows for application crashes and potential code execution via abnormally constructed objects and JavaScript triggers.

Executive Summary:
A critical vulnerability in Foxit PDF Editor and Reader caused by improper input validation during signature verification could allow an attacker to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-57246

Affected Software: Foxit PDF Editor and Reader

Affected Versions: Foxit PDF Editor: 2026.1.1, 14.0.4, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application fails to perform adequate argument validation when processing abnormally constructed objects. An attacker can leverage JavaScript to trigger signature verification, where the plugin fails to validate string copying, resulting in a buffer copy error (CWE-120).

Business Impact

The CVSS score of 7.8 (High) reflects the potential for complete impact on confidentiality, integrity, and availability. Successful exploitation requires user interaction but could lead to unauthorized code execution, resulting in full system compromise, data theft, or service disruption for the affected workstation.

Remediation Plan

Immediate Action: Update to the latest version of Foxit PDF Editor or Reader as provided by the vendor’s official security bulletin.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unauthorized attempts to execute scripts within PDF documents.

Compensating Controls: Disable JavaScript in PDF settings across the enterprise to prevent the triggering of automated malicious scripts until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this buffer-related vulnerability, administrators should prioritize the deployment of vendor-supplied updates. If an immediate update is not feasible, restricting the execution of JavaScript in PDF documents is strongly recommended to reduce the attack surface.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor / Foxit PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader arises from improper validation of annotation relationships and field combinations during hyperlink processing.

Executive Summary:
Failure to validate annotation relationships in Foxit PDF Editor and Reader creates a use-after-free vulnerability that could facilitate unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-57245

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The vulnerability involves a flaw in how the application handles annotation elements related to hyperlinks. An unauthenticated attacker can exploit this via a crafted PDF that triggers an invalid memory operation during the parsing of complex field combinations.

Business Impact

The exploitation of this flaw poses a severe risk to organizational security, as it allows for memory corruption that can be leveraged for code execution. Given the CVSS score of 7.8, this issue presents a high risk of system compromise and potential lateral movement if the affected workstation is integrated into a corporate network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit to resolve the memory validation errors in the annotation processing engine.

Proactive Monitoring: Review security logs for instances of PDF reader instability or unauthorized memory access violations on endpoints.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to detect and block suspicious exploit attempts involving document parsing.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is necessary to mitigate this high-risk vulnerability. Security teams should ensure that all instances of Foxit PDF software are updated to versions that explicitly address these memory safety concerns.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor/Reader occurs due to a lack of re-entry protection and object verification during form synchronization, leading to control pointer failure.

Executive Summary:
A critical use-after-free flaw in Foxit PDF software, caused by improper form synchronization, exposes users to potential arbitrary code execution if they open a malicious PDF.

Vulnerability Details

CVE-ID: CVE-2026-57244

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) arises because the form synchronization process fails to implement re-entry protection or verify object lifecycles after a JavaScript reset. This leads to the failure of control pointers during traversal, which an attacker can exploit to gain control over the application's execution flow.

Business Impact

The CVSS score of 7.8 highlights the high risk of this vulnerability, which could result in severe operational disruption or data breaches. Successful exploitation allows an attacker to bypass security controls and execute arbitrary code, threatening the confidentiality and integrity of the local system.

Remediation Plan

Immediate Action: Update all affected Foxit PDF Editor and Reader software to the latest version immediately upon release of the vendor patch.

Proactive Monitoring: Monitor host-based security systems for suspicious behaviors, such as unexpected memory access patterns, when users interact with PDF files.

Compensating Controls: Leverage endpoint protection platforms (EPP) and Web Application Firewalls (WAF) to detect and block malicious PDF payloads before they reach the endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a serious security weakness that requires immediate attention. Organizations must prioritize the patch deployment process and ensure that all users are running the most secure, updated versions of the Foxit software to prevent potential exploitation.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in Foxit PDF Editor and Reader where JavaScript-driven form modifications can lead to memory corruption and potential system instability.

Executive Summary:
A high-severity memory corruption vulnerability in Foxit PDF software allows for potential arbitrary code execution when processing specially crafted PDF forms containing JavaScript.

Vulnerability Details

CVE-ID: CVE-2026-57242

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: The application is susceptible to a use-after-free (CWE-416) condition when JavaScript modifies a PDF form. This flaw permits an attacker to influence memory state, which can be leveraged for code execution if the user is induced to open a malicious document.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a severe threat to business continuity and data security. Exploitation could allow an attacker to execute commands with the privileges of the logged-in user, potentially leading to unauthorized access to sensitive files or lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit to all affected installations of PDF Editor and Reader.

Proactive Monitoring: Review endpoint security logs for signs of anomalous memory usage or unauthorized process spawning linked to the PDF reader.

Compensating Controls: Utilize security software to enforce restrictive policies on PDF viewer settings, specifically disabling JavaScript execution where business requirements allow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk associated with this vulnerability is significant, as it provides a path for remote code execution. Security teams must ensure that all instances of Foxit PDF software are updated immediately upon the availability of a patch to neutralize this attack vector.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor/Reader occurs when JavaScript deletes PDF fields, leading to invalid pointer references and potential application crashes or arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to trigger invalid pointer references through malicious JavaScript, risking arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-57240

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a Use-After-Free (CWE-416) vulnerability triggered when the application processes a PDF containing JavaScript that deletes form fields. The application fails to update pointers correctly, allowing an attacker to manipulate memory, which typically requires user interaction to open the malicious file.

Business Impact

The CVSS score of 7.8 (High) reflects the significant risk posed by this vulnerability. Successful exploitation could lead to total system compromise, unauthorized data access, or denial-of-service, directly impacting the integrity and availability of workstations handling sensitive PDF documentation.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest available versions provided by the vendor as soon as they are released.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unexpected child processes originating from the PDF reader environment.

Compensating Controls: Implement organizational policies to restrict the execution of JavaScript within PDF viewers and utilize endpoint security solutions to block suspicious file execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the potential for arbitrary code execution, this vulnerability poses a substantial risk to organizational assets. Administrators should prioritize deploying vendor-supplied patches as soon as they become available to mitigate the risk of memory corruption-based attacks.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Foxit PDF Editor and Reader contain an uncontrolled search path vulnerability that allows low-privileged users to achieve system-level code execution.

Executive Summary:
A privilege escalation vulnerability in Foxit PDF Editor and Reader allows local attackers to achieve NT AUTHORITY\SYSTEM access by exploiting uncontrolled search path elements.

Vulnerability Details

CVE-ID: CVE-2026-57239

Affected Software: Foxit PDF Editor and Reader

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an uncontrolled search path element vulnerability (CWE-427) where user-controlled executable files are executed by high-privilege system processes. By placing a malicious file in a specific location, a low-privileged user can force the application to execute the malicious payload with system-level privileges.

Business Impact

The ability to escalate privileges to NT AUTHORITY\SYSTEM is a critical security event, as it grants the attacker complete control over the local machine. With a CVSS score of 8.2, this vulnerability allows for total compromise of the affected host, including the theft of credentials, data exfiltration, and the installation of persistent malware.

Remediation Plan

Immediate Action: Consult the official Foxit security bulletin to identify the specific patched versions and apply the updates immediately.

Proactive Monitoring: Monitor endpoints for the creation of unexpected executable files in application directories or suspicious child processes spawned by Foxit applications.

Compensating Controls: Deploy endpoint security solutions that can detect and block unauthorized privilege escalation attempts or the execution of unsigned binaries from application-specific directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability allows for full system compromise, it should be treated with the highest priority. Administrators should audit their environments for vulnerable versions of Foxit PDF Editor and Reader and ensure that all instances are updated to the secure versions recommended by the vendor.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor / PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader permits arbitrary code execution when JavaScript performs invalid operations on deleted form field objects.

Executive Summary:
A critical use-after-free vulnerability in Foxit software enables potential system exploitation via malicious PDF files that manipulate form field object lifecycles.

Vulnerability Details

CVE-ID: CVE-2026-57238

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a Use-After-Free (CWE-416) vulnerability triggered when JavaScript deletes a form field object while the application continues to reference it. This memory management error can be leveraged by attackers to execute malicious code on the host machine.

Business Impact

The CVSS score of 7.8 highlights the high risk associated with this vulnerability. Exploitation can lead to the unauthorized execution of code, which may result in data exfiltration, system instability, or the deployment of ransomware within the enterprise environment.

Remediation Plan

Immediate Action: Upgrade to the most recent version of the software provided by the vendor to address the memory management flaw.

Proactive Monitoring: Implement robust logging on endpoints to identify unexpected application behavior or memory access violations.

Compensating Controls: Apply organizational policies that restrict the execution of JavaScript in PDF viewers, reducing the attack surface for document-based exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the deployment of vendor-supplied patches to eliminate this use-after-free vulnerability. Given the ease with which such flaws can be weaponized in phishing campaigns, immediate patching is recommended to secure the environment against potential exploitation.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor / PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to execute arbitrary code by manipulating form field properties via JavaScript.

Executive Summary:
A high-severity use-after-free flaw in Foxit PDF Editor and Reader poses a significant risk of arbitrary code execution through specially crafted PDF documents.

Vulnerability Details

CVE-ID: CVE-2026-57237

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This vulnerability (CWE-416) occurs when JavaScript modifies form field properties, causing the application to reference invalid memory states. This creates a use-after-free condition that can be exploited by an attacker when a victim opens a malicious PDF.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a significant threat to organizational security. Successful exploitation could lead to full system compromise, enabling attackers to bypass security controls and access sensitive information stored on the affected endpoint.

Remediation Plan

Immediate Action: Apply the latest vendor security patches immediately to all affected systems.

Proactive Monitoring: Review application logs for unusual crashes or errors during PDF processing, as these can serve as indicators of an attempted exploit.

Compensating Controls: Utilize endpoint detection and response (EDR) tools to monitor for unauthorized child processes initiated by the PDF reader application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Prompt remediation is necessary to mitigate the risk of remote code execution. Security teams should verify that all instances of Foxit PDF Editor and Reader are updated to versions released after the patch cycle to ensure the use-after-free condition is fully resolved.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor / PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows attackers to execute arbitrary code via a maliciously crafted PDF file using a damaged field tree.

Executive Summary:
A high-severity use-after-free vulnerability in Foxit PDF Editor and Reader could allow an attacker to gain unauthorized control over a user's system.

Vulnerability Details

CVE-ID: CVE-2026-13129

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a Use-After-Free (CWE-416) vulnerability triggered when the application processes a PDF containing a damaged field tree. An attacker can leverage JavaScript to trigger invalid object access, requiring user interaction to open the malicious file.

Business Impact

The CVSS score of 7.8 (High) reflects the potential for complete compromise of system confidentiality, integrity, and availability. Successful exploitation allows remote code execution in the context of the user, which could result in data theft, installation of malware, or lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update to the latest version of Foxit PDF Editor or Reader as specified in the official vendor security bulletin.

Proactive Monitoring: Monitor endpoint logs for suspicious process spawning behavior related to the Foxit application suite.

Compensating Controls: Deploy endpoint protection solutions capable of detecting malicious PDF document patterns and restrict the execution of JavaScript within PDF viewers via Group Policy if business requirements allow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the prevalence of PDF-based attack vectors, organizations should treat this vulnerability with urgency. Prioritize patching all workstations running affected versions of Foxit PDF Editor and Reader to prevent potential arbitrary code execution.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Foxit PDF Editor and Reader allows for potential code execution when processing PDFs with embedded JavaScript.

Executive Summary:
A high-severity use-after-free flaw in Foxit PDF Editor and Reader can be exploited by an attacker to execute arbitrary code through a maliciously crafted PDF file.

Vulnerability Details

CVE-ID: CVE-2026-13128

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor (2026.1.1 and earlier), Foxit PDF Reader (2026.1.1 and earlier)

Vulnerability: The application is vulnerable to a use-after-free (CWE-416) condition when handling embedded JavaScript that triggers page deletion. Exploitation requires a user to open a malicious PDF, which then leads to invalid object memory handling.

Business Impact

The CVSS score of 7.8 indicates a high risk of compromise for affected endpoints. Successful exploitation allows an attacker to execute arbitrary code, potentially leading to the exfiltration of sensitive information or the deployment of ransomware within the enterprise environment.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Foxit for both PDF Editor and Reader.

Proactive Monitoring: Review enterprise security logs for suspicious file execution patterns associated with PDF reader applications.

Compensating Controls: Implement organizational policies to disable JavaScript in PDF readers and utilize endpoint security solutions to detect and block malicious document execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the prevalence of PDF-based attacks, it is critical to address this vulnerability promptly. Organizations should verify that all instances of Foxit PDF software are updated to the current secure version to protect against potential exploitation.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor / Foxit PDF Reader
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in Foxit PDF Editor and Reader, which may allow an attacker to execute arbitrary code when opening a maliciously crafted PDF file.

Executive Summary:
A critical use-after-free vulnerability in Foxit PDF Editor and Reader could allow an attacker to achieve code execution through a specially crafted PDF document.

Vulnerability Details

CVE-ID: CVE-2026-13127

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier

Vulnerability: This is a use-after-free vulnerability (CWE-416) triggered when the application processes a PDF file. The vulnerability requires user interaction to open the malicious file, but once opened, an unauthenticated attacker could potentially gain control of the application process.

Business Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution on the host system, potentially resulting in data exfiltration, unauthorized access to sensitive documents, or complete system compromise. With a CVSS score of 7.8, this vulnerability is classified as High severity, as it poses a significant risk to the integrity and confidentiality of end-user workstations.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest available versions released by the vendor to patch the underlying memory corruption issue.

Proactive Monitoring: Monitor endpoint logs for abnormal application crashes or unexpected child processes spawned by the PDF reader.

Compensating Controls: Restrict the ability of PDF readers to execute scripts or access network resources via endpoint security policies until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of use-after-free vulnerabilities in document processing software, organizations should prioritize deploying the latest vendor updates across all workstations. Users should be advised to exercise caution when opening unsolicited PDF files from untrusted sources.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Editor
AFFECTED_VERSIONS: Foxit PDF Editor: 2026.1.1 and earlier, 14.0.4 and earlier; Foxit PDF Reader: 2026.1.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Foxit PDF Editor and Reader are susceptible to a use-after-free vulnerability triggered by maliciously crafted JavaScript within a PDF document.

Executive Summary:
A high-severity use-after-free vulnerability in Foxit PDF Editor and Reader allows an attacker to execute arbitrary code or cause system crashes through malicious PDF documents.

Vulnerability Details

CVE-ID: CVE-2026-13126

Affected Software: Foxit PDF Editor and Foxit PDF Reader

Affected Versions: Foxit PDF Editor (2026.1.1 and earlier, 14.0.4 and earlier), Foxit PDF Reader (2026.1.1 and earlier)

Vulnerability: This vulnerability (CWE-416) occurs when embedded JavaScript in a PDF file deletes objects, leading to a use-after-free condition. It requires user interaction, such as opening a specially crafted PDF, to trigger the flaw.

Business Impact

With a CVSS score of 7.8, this flaw poses a substantial risk of remote code execution. A successful exploit could lead to full system compromise, unauthorized data access, and potential malware installation, impacting organizational security posture and data confidentiality.

Remediation Plan

Immediate Action: Update Foxit PDF Editor and Reader to the latest patched versions provided by the vendor.

Proactive Monitoring: Monitor endpoint activity for abnormal process behavior or crashes associated with the PDF application.

Compensating Controls: Disable JavaScript execution within PDF reader settings if immediate patching is not feasible, and restrict the opening of untrusted PDF documents.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to end-user workstations. Organizations should mandate the update to the latest version of Foxit software to mitigate the possibility of arbitrary code execution via malicious documents.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit AI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A sandbox bypass vulnerability in Foxit AI allows remote code execution when processing malicious PDF files containing embedded JavaScript.

Executive Summary:
Foxit AI contains a critical remote code execution vulnerability that allows attackers to escape the sandbox via malicious PDF files.

Vulnerability Details

CVE-ID: CVE-2026-12057

Affected Software: Foxit AI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists because the application fails to properly intercept dangerous interfaces when executing embedded JavaScript within a PDF. This failure allows remote scripts to be loaded, resulting in arbitrary code execution within the context of the application.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a major risk. An attacker could exploit this by enticing a user to open a specially crafted PDF document, leading to code execution that could compromise the user's workstation or gain a foothold within the corporate network.

Remediation Plan

Immediate Action: Update Foxit AI software to the latest version as recommended by the Foxit security bulletin.

Proactive Monitoring: Monitor for suspicious PDF activity and utilize endpoint protection solutions to block the execution of unauthorized scripts spawned by document readers.

Compensating Controls: Disable JavaScript execution within PDF readers via group policy or application settings to prevent the exploitation of this and similar vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution vulnerabilities in document readers are highly effective attack vectors. Organizations should deploy the latest patches immediately and consider disabling PDF JavaScript execution as a proactive security measure.

Executive Summary:
A high-severity vulnerability exists within the Foxit PDF Reader's update service that could allow a local attacker to gain complete control over an affected system. An authenticated user with basic permissions could exploit this flaw to escalate their privileges to the highest level, enabling them to install malware, steal sensitive data, or compromise the entire workstation.

Vulnerability Details

CVE-ID: CVE-2025-9330

Affected Software: Foxit Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an Uncontrolled Search Path Element, commonly known as DLL Hijacking. The Foxit PDF Reader Update Service, which typically runs with elevated (SYSTEM) privileges, attempts to load a required library (DLL) or executable without specifying a secure, absolute path. An attacker with low-level user access can place a malicious file with the same name in a location that the application searches before the legitimate file's directory. When the update service is triggered, it will inadvertently load and execute the attacker's malicious code with SYSTEM-level privileges, leading to a full system compromise.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. A successful exploit would allow a low-privileged user to escalate their privileges to that of an administrator on the local machine. This could have significant business consequences, including the theft or modification of sensitive corporate data, the deployment of ransomware or other malware, and the use of the compromised system as a pivot point for lateral movement to attack other critical assets on the network. This undermines the principle of least privilege and can turn a minor user account compromise into a full-scale system breach.

Remediation Plan

Immediate Action:

• Patching: Apply the security updates provided by Foxit across all affected workstations and servers immediately. Prioritize systems accessible by a broad user base.
• Access Control Review: Audit user permissions on endpoints to ensure the principle of least privilege is enforced. Standard users should not have write permissions to system directories or application installation folders.

Proactive Monitoring:

• Endpoint Detection and Response (EDR): Monitor for suspicious process creation events originating from the Foxit update service process (e.g., FoxitUpdater.exe). Pay close attention to the loading of DLLs from unusual or user-writable locations like C:\Windows\Temp\ or user profile directories.
• File Integrity Monitoring (FIM): Implement FIM to alert on the creation of new DLL or EXE files in the Foxit application directories by unprivileged users.
• Log Analysis: Review Windows Event Logs for signs of privilege escalation, such as a user account being unexpectedly added to the local Administrators group.

Compensating Controls:

• Application Whitelisting: Deploy application control solutions (e.g., Windows Defender Application Control, AppLocker) to prevent the execution of unauthorized executables or libraries from non-standard paths.
• Harden Search Paths: If possible, modify system environment variables to remove user-writable directories from the system's DLL search order, although this can have unintended consequences.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 2, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, local privilege escalation vulnerabilities based on uncontrolled search paths are well-understood and proof-of-concept code is often developed quickly by security researchers. Organizations should assume that an exploit could become available at any time.

Analyst Recommendation

Given the high CVSS score of 7.8 and the widespread deployment of Foxit products in enterprise environments, this vulnerability poses a significant risk. A successful exploit would grant an attacker complete control over a compromised endpoint, bypassing existing security controls. Although this vulnerability is not currently listed on the CISA KEV catalog, it should be prioritized for immediate remediation. We strongly recommend that organizations apply the vendor-supplied patches to all affected systems without delay to prevent potential exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple Foxit products, allowing for remote code execution. An attacker could exploit this by tricking a user into opening a specially crafted PDF file, which could allow the attacker to take full control of the affected system, leading to data theft, malware installation, or further network intrusion.

Vulnerability Details

CVE-ID: CVE-2025-9329

Affected Software: Foxit Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Out-Of-Bounds Read condition that occurs when a vulnerable version of Foxit software parses a malformed PRC (Product Representation Compact) file, which can be embedded within a PDF document. An attacker can create a malicious PRC file that causes the application to read data from outside of its intended memory buffer. This memory corruption can be leveraged by an attacker to divert the program's execution flow, ultimately leading to arbitrary code execution in the context of the current user. Exploitation requires a user to open the malicious file.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Successful exploitation could have a significant business impact, allowing an attacker to execute arbitrary code with the privileges of the user running the Foxit application. This could lead to the compromise of sensitive corporate data, deployment of ransomware, installation of persistent backdoors for long-term access, or using the compromised machine as a pivot point to attack other internal network resources. The risk is elevated for organizations where employees frequently open PDF documents from external sources, such as email attachments or web downloads.

Remediation Plan

Immediate Action: Apply the security patches released by Foxit to all affected systems immediately. Priority should be given to systems that interact with external documents, such as user workstations. In parallel, security teams should actively monitor for signs of exploitation, such as unexpected application crashes or suspicious child processes spawning from Foxit applications, and review relevant system and network access logs.

Proactive Monitoring: Implement enhanced monitoring to detect potential exploitation attempts. This includes monitoring for abnormal process behavior from Foxit Reader/Editor executables (e.g., launching cmd.exe or powershell.exe), inspecting network traffic for unusual outbound connections from workstations after a PDF has been opened, and configuring EDR/antivirus solutions to alert on memory corruption or code injection techniques.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Educate users about the threat and advise them not to open PDF files from untrusted or unsolicited sources.
• Use application control solutions to prevent Foxit products from creating child processes.
• Ensure web and email security gateways are configured to scan and block malicious PDF files.
• Restrict user permissions to limit the potential impact of a successful exploit.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of September 2, 2025, there are no known public proof-of-concept exploits or reports of active exploitation in the wild. However, vulnerabilities of this type (remote code execution in a popular client-side application) are attractive targets for threat actors. It is highly probable that a functional exploit will be developed. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 7.8) and the potential for complete system compromise, it is strongly recommended that organizations prioritize the deployment of the vendor-supplied patches for CVE-2025-9329 across all affected endpoints. Although there is no evidence of active exploitation at this time, the risk of future exploitation is high. Organizations should treat this as a critical vulnerability and aim to complete patching within their standard critical vulnerability remediation timelines.

Executive Summary:
A high-severity vulnerability has been identified in multiple Foxit software products, which could allow an attacker to take full control of a user's system. This is achieved by tricking a user into opening a specially crafted PDF file, which can lead to remote code execution, posing a significant risk of data theft, malware infection, and system compromise.

Vulnerability Details

CVE-ID: CVE-2025-9328

Affected Software: Foxit Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an Out-Of-Bounds Read condition within the PRC (Product Representation Compact) file parsing engine of Foxit PDF Reader. An attacker can craft a malicious PRC object and embed it within a PDF document. When a user opens this document, the vulnerable software attempts to read data beyond the boundary of an allocated memory buffer, which can be leveraged by the attacker to corrupt memory and execute arbitrary code with the privileges of the current user.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Successful exploitation could lead to a complete compromise of the affected endpoint, allowing an attacker to install malware (such as ransomware or spyware), exfiltrate sensitive corporate or personal data, and use the compromised machine as a pivot point to move laterally within the network. The potential business impact includes data breaches, financial loss, operational disruption, and significant reputational damage.

Remediation Plan

Immediate Action: Apply the security patches released by Foxit immediately, prioritizing all endpoints where the affected software is installed. For internet-facing systems or those handled by users who frequently interact with external documents, this action is critical. Concurrently, monitor for signs of exploitation by reviewing application and system logs for any unusual activity originating from Foxit processes.

Proactive Monitoring: Security teams should configure monitoring and alerting for suspicious process chains originating from Foxit PDF Reader (e.g., FoxitPDFReader.exe spawning powershell.exe, cmd.exe, or other unexpected processes). Monitor network traffic for unusual outbound connections from workstations running Foxit products. Endpoint Detection and Response (EDR) solutions should be tuned to detect memory corruption and process injection techniques.

Compensating Controls: If immediate patching is not feasible, consider implementing the following controls:

• Use application control solutions to prevent Foxit Reader from launching child processes like command-line interpreters or scripts.
• Enforce email and web security gateway policies to scan for and block or quarantine PDF files from untrusted sources.
• Educate users on the risks of opening unsolicited attachments and links, even if they appear to be standard documents.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 2, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the nature of the vulnerability (Remote Code Execution) and the widespread use of Foxit products, it is highly likely that threat actors will develop exploits in the near future. The requirement for user interaction (opening a malicious file) makes this a prime candidate for phishing campaigns.

Analyst Recommendation

Due to the high severity (CVSS 7.8) and the critical risk of remote code execution, this vulnerability requires immediate attention. Organizations are strongly advised to prioritize the deployment of vendor-supplied security patches across all affected endpoints to mitigate this threat. While this vulnerability is not currently listed on the CISA KEV catalog, its high potential for exploitation warrants treating it with the same urgency as a known exploited vulnerability. Continue to monitor for any changes in its exploitation status and apply compensating controls where patching is delayed.

Executive Summary:
A high-severity vulnerability has been discovered in multiple Foxit products that could allow an attacker to take full control of a user's computer. This flaw is triggered when a user opens a specially crafted malicious PDF file, which could lead to data theft, malware installation, and further network compromise. Immediate patching is required to mitigate this significant risk.

Vulnerability Details

CVE-ID: CVE-2025-9326

Affected Software: Foxit Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an Out-Of-Bounds Read that occurs during the parsing of PRC (Product Representation Compact) files embedded within a PDF document. An attacker can craft a malicious PRC object that, when processed by a vulnerable version of Foxit software, causes the application to read data from outside its intended memory buffer. This memory corruption can be leveraged by the attacker to crash the application, disclose sensitive information from memory, or, most critically, achieve remote code execution (RCE) in the security context of the user who opened the file.

Business Impact

This is a High severity vulnerability with a CVSS score of 7.8. Successful exploitation could lead to a complete compromise of the affected user's workstation. The business impact includes the potential for data exfiltration of sensitive corporate information, deployment of ransomware or spyware, and the use of the compromised system as a foothold to launch further attacks against the internal network. A compromise originating from a widely used application like a PDF reader can undermine user trust and lead to significant operational disruption and data loss.

Remediation Plan

Immediate Action: Apply the security patches released by Foxit immediately to all workstations with vulnerable software installations. Prioritize patching for systems used by high-risk users or those handling sensitive data. Security teams should actively monitor for signs of exploitation and review application and system logs for any anomalous activity related to Foxit PDF Reader.

Proactive Monitoring: Implement monitoring to detect potential exploitation attempts. Look for application crash logs from Foxit processes, which could indicate a failed exploit. Use Endpoint Detection and Response (EDR) solutions to monitor for suspicious child processes being spawned by Foxit PDF Reader (e.g., FoxitPDFReader.exe launching cmd.exe or powershell.exe). Monitor network traffic for unusual outbound connections from workstations immediately after a PDF file has been opened.

Compensating Controls: If patching cannot be immediately deployed, implement the following controls to reduce risk:

• Configure email and web security gateways to scan and block PDF files containing malicious or malformed PRC objects.
• Use application control or whitelisting to prevent Foxit processes from executing unauthorized commands or creating new executable files.
• Enforce user awareness training, reminding employees to be cautious and not open PDF attachments or links from untrusted or unsolicited sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 2, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities of this type in popular document readers are prime targets for exploit development by both security researchers and malicious actors. The likelihood of a functional exploit being developed and used in targeted attacks is high.

Analyst Recommendation

This vulnerability presents a significant risk and requires immediate attention. The primary recommendation is to prioritize the deployment of the vendor-supplied patches across all affected systems within the organization. Although CVE-2025-9326 is not currently on the CISA KEV list, its high CVSS score and potential for remote code execution warrant treating it with the urgency of an actively exploited threat. Security teams should concurrently enhance monitoring capabilities to detect any post-patching exploitation attempts against unpatched systems.