Skip to content
OpenAdvisories
High · 7.8 CVE-2026-13128 EUVD-2026-42185GHSA-v4qp-8g92-cj69

Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by Foxit

Description

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

Affected products

VendorProductAffectedFixed
Foxit Software Foxit PDF Editor Versions 2026.1.1 and earlier —
Foxit Software Foxit PDF Reader Versions 2026.1.1 and earlier —

Advisories 1

References