Skip to content
OpenAdvisories
Medium WID-SEC-2026-1281 7 CVEs

Foxit PDF Reader und Editor: Mehrere Schwachstellen

Published Apr 26, 2026 · Updated Apr 27, 2026 · Revision 2 · de-DE

Vendor: Foxit Product: PDF Editor Product: PDF Reader Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Foxit PDF Reader und Foxit PDF Editor ausnutzen, um einen Denial of Service Angriff durchzuführen oder Code auszuführen.

Product

Foxit PDF Reader ist ein Programm zur Anzeige von PDF Dateien.
Foxit PDF Editor ist ein Tool zur Bearbeitung von PDF-Dateien.

Vulnerabilities 7

  • High 7.8
    CVE-2026-5940

    Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

    Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

    Foxit Foxit PDF Reader foxit_pdf_editor
  • High 7.8
    CVE-2026-5941

    Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability

    Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.

    Foxit Foxit PDF Reader foxit_pdf_editor
  • High 7.8
    CVE-2026-5943

    Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability

    Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an inval…

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 5.5
    CVE-2026-5937

    Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability

    Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 5.5
    CVE-2026-5938

    Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability

    Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 5.5
    CVE-2026-5939

    UAF in Foxit PDF Editor/Reader via XFA calculate event

    A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 5.5
    CVE-2026-5942

    Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability

    Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.

    Foxit Foxit PDF Reader foxit_pdf_editor

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-25826, EUVD-2026-25828, EUVD-2026-25829, EUVD-2026-25825, EUVD-2026-25827, EUVD-2026-25823, EUVD-2026-25824

  2. #1

    Initiale Fassung

References