CVE-2026-13126: Use-After-Free in Foxit PDF Reader and Editor – HIGH Severity Crash Vulnerability

Technical summary

CVE-2026-13126 is a use-after-free vulnerability (CWE-416) affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. The attack chain begins when embedded JavaScript within a PDF deletes pages, invalidating the document's object tree. The application does not properly validate the integrity of pop-up annotation objects after this mutation. When the renderer attempts a write operation on these now-freed or invalidated annotation pointers, a memory access violation occurs, causing an immediate crash. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, no privilege requirement, and user interaction. The impact encompasses confidentiality, integrity, and availability.

Business impact

Organizations relying on Foxit PDF Editor or PDF Reader for document processing face immediate denial of service when users open crafted PDF files. In environments where PDFs are batch-processed or where automated workflows depend on these tools, this vulnerability could disrupt productivity. Additionally, the crash may expose sensitive data in process memory if crash dumps are not secured. The low barrier to exploitation (user must simply open a file) makes this a practical attack vector in targeted phishing or watering hole scenarios. Unpatched systems represent a measurable business continuity risk.

Affected systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader running on Microsoft Windows systems. The exact affected version range is not specified in the vulnerability record; organizations must consult the vendor advisory to determine which releases are vulnerable and which patch versions resolve the issue. Any Windows deployment of these products should be considered potentially affected until patched.

Exploitability

This vulnerability is moderately exploitable. It requires user interaction—an end user must open a malicious PDF file—but no special privileges or complex system configuration. The attack surface is broad: delivery could occur via email attachment, website download, or network share. Once a user opens the crafted PDF, the crash is triggered automatically. The simplicity of the attack (embedding JavaScript in a PDF) and the prevalence of PDF distribution in business workflows suggest this vulnerability could see active exploitation if not promptly patched. However, it does not appear to be actively exploited in the wild at this time, as it is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Patch Foxit PDF Editor and Foxit PDF Reader to the vendor-recommended fixed version immediately. Verify the exact patch version against Foxit's security advisory. In the interim, implement user awareness training to discourage opening unsolicited PDF files, especially from untrusted sources. Consider restricting PDF file types or disabling JavaScript execution in PDF readers where business requirements permit. Network segmentation and endpoint monitoring can help detect attempts to deliver malicious PDFs to high-value targets.

Patch guidance

Consult the official Foxit security advisory for CVE-2026-13126 to identify the specific patch version for both PDF Editor and PDF Reader. Update mechanisms vary; verify whether your deployment uses automatic updates or manual patch deployment. Test the patch in a non-production environment first to ensure compatibility with existing workflows and integrations. Document the patch date and version in your vulnerability management system for compliance reporting.

Detection guidance

Monitor for application crashes involving Foxit PDF Editor or PDF Reader processes, particularly crashes that occur immediately after PDF file access. Collect and analyze crash dumps for signatures of memory corruption. On the network level, watch for delivery of unexpected PDF files to end users, particularly those with suspicious origins or from external domains. Endpoint Detection and Response (EDR) tools should flag suspicious JavaScript execution within PDF processing contexts. Web content filters can reduce delivery of malicious PDFs by blocking known bad file sources or suspicious PDF characteristics.

Why prioritize this

This vulnerability merits prompt patching due to its HIGH CVSS score (7.8), low attack complexity, and widespread user interaction with PDFs in business environments. Although not yet in the KEV catalog, the straightforward exploitation method and moderate real-world applicability justify prioritizing it ahead of lower-severity issues. Organizations should treat this as a near-term remediation target, particularly for endpoints where end users frequently receive external PDF files.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a high-risk vulnerability: local attack vector (user must open a file on Windows), low attack complexity (no special configuration needed), no privilege requirement, and user interaction necessary. The impact rating spans confidentiality (data in memory during crash), integrity (file corruption), and availability (denial of service via crash). This combination results in a HIGH severity classification. The score does not account for ease of delivery or prevalence of affected applications, which would further elevate practical risk in many organizations.

Frequently asked questions