Skip to content
OpenAdvisories
High · 7.8 CVE-2026-13126 EUVD-2026-42187GHSA-x96h-38x4-vxv6

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by Foxit

Description

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.

Affected products

VendorProductAffectedFixed
Foxit Software Foxit PDF Editor Versions 2026.1.1 and earlier, Versions 14.0.4 and earlier —
Foxit Software Foxit PDF Reader Versions 2026.1.1 and earlier —

Advisories 1

References