Skip to content
OpenAdvisories
Medium WID-SEC-2026-0934 11 CVEs

Foxit PDF Editor und Reader: Mehrere Schwachstellen

Published Mar 30, 2026 · Updated Apr 6, 2026 · Revision 3 · de-DE

Vendor: Foxit Product: PDF Editor Product: PDF Reader Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Foxit PDF Editor und Foxit PDF Reader ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder Code auszuführen. .

Product

Foxit PDF Editor ist ein Tool zur Bearbeitung von PDF-Dateien.
Foxit PDF Reader ist ein Programm zur Anzeige von PDF Dateien.

Vulnerabilities 11

  • High 7.8
    CVE-2026-3775

    Foxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

    The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may b…

    Foxit Foxit PDF Reader foxit_pdf_editor
  • High 7.8
    CVE-2026-3779

    Foxit PDF Editor/Reader List Box Calculate Array Use-After-Free Vulnerability

    The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary co…

    Foxit Foxit PDF Reader foxit_pdf_editor
  • High 7.3
    CVE-2026-3780

    Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation

    The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them…

    Foxit Foxit PDF Reader foxit_pdf_editor
  • High 7.1
    CVE-2026-4947

    Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign

    Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-suppl…

    Foxit na1.foxitesign.foxit.com
  • Medium 6.3
    CVE-2026-1591

    Stored XSS via Attachments Feature in https://pdfonline.foxit.com/

    Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is di…

    Foxit pdfonline.foxit.com
  • Medium 6.3
    CVE-2026-1592

    Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud

    Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced. This issue …

    Foxit pdfonline.foxit.com
  • Medium 6.2
    CVE-2026-3778

    Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader

    The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal c…

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 6.1
    CVE-2025-66523

    Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters

    URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link. This issue affects na1.foxitesign.foxit.c…

    Foxit na1.foxitesign.foxit.com
  • Medium 5.5
    CVE-2026-3776

    Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation

    The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior n…

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 5.5
    CVE-2026-3777

    Use after free of view cache in Foxit PDF Editor/Reader

    The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object …

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 4.7
    CVE-2026-3774

    Self-Modifications Affecting Altered Printing and Redaction in Foxit PDF Editor

    The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redaction, encryption, or printing. These script‑driven updates are…

    Foxit foxit_pdf_editor

Revision history

  1. #3

    Referenz(en) aufgenommen: ZDI-26-251, ZDI-CAN-28595

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-17761, EUVD-2026-17749, EUVD-2026-17751, EUVD-2026-17753, EUVD-2026-17755, EUVD-2026-17757, EUVD-2026-17759, EUVD-2026-17767

  3. #1

    Initiale Fassung

References