CVE-2026-5938

Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability

Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5939

UAF in Foxit PDF Editor/Reader via XFA calculate event

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5940

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5941

Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5942

Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability

Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5943

Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability

Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-3779

Foxit PDF Editor/Reader List Box Calculate Array Use-After-Free Vulnerability

The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-3780

Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation

The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-1591

Stored XSS via Attachments Feature in https://pdfonline.foxit.com/

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed. This issue affects pdfonline.foxit.com: before 2026‑02‑03.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Cloud Pdfonline

CVE-2026-1592

Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced. This issue affects pdfonline.foxit.com: before 2026‑02‑03.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Cloud Pdfonline

CVE-2026-3777

Use after free of view cache in Foxit PDF Editor/Reader

The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-3778

Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader

The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-3776

Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation

The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-3775

Foxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2011-10030

Foxit PDF Reader < 4.3.1.0218 JavaScript File Write

Foxit PDF Reader <  4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Foxit Reader

CVE-2010-20010

Foxit PDF Reader < 4.2.0.0928 Title Stack Buffer Overflow

Foxit PDF Reader before 4.2.0.0928 does not properly bound-check the /Title entry in the PDF Info dictionary. A specially crafted PDF with an overlong Title string can overflow a fixed-size stack buffer, corrupt the Structured Exception Handler (SEH) chain, and lead to arbitrary code execution in the context of the user who opens the file.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Foxit Reader

CVE-2026-3774

Self-Modifications Affecting Altered Printing and Redaction in Foxit PDF Editor

The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redaction, encryption, or printing. These script‑driven updates are not fully covered by the existing redaction, encryption, and printing logic, which, under specific document structures and user workflows, may cause a small amount of sensitive content to remain unremoved or unencrypted as expected, or result in printed output that slightly differs from what was reviewed on screen.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2025-66499

Foxit PDF Reader PDF Parsing Heap-Based Buffer Overflow Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in the calculation of the image buffer size may occur, potentially allowing a remote attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxit Software and 2 more

Products

Macos Pdf Editor Pdf Reader and 4 more

CVE-2025-66497

Foxit PDF Reader 3D Annotation Out-of-Bounds Memory Access Vulnerability

A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When opening a PDF file containing malformed or specially crafted PRC content, out-of-bounds memory access may occur, resulting in memory corruption.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 2 more

CVE-2025-66498

Foxit PDF Reader 3D Annotation Out-of-Bounds Memory Access Vulnerability

A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing U3D data. When opening a PDF file containing malformed or specially crafted PRC content, out-of-bounds memory access may occur, resulting in memory corruption.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxit Software Foxitsoftware and 1 more

Products

Pdf Editor Pdf Reader Reader and 3 more