CVE-2026-13127: Foxit PDF Reader/Editor Use-After-Free Crash Vulnerability

Technical summary

CVE-2026-13127 is a use-after-free vulnerability (CWE-416) affecting PDF readers and editors. The vulnerability occurs when JavaScript embedded in a PDF modifies the document's page structure, invalidating page object references. The thumbnail generation subsystem fails to update its references and continues to use the stale page objects, resulting in a crash when thumbnails are rendered or accessed. The attack surface is local; the PDF must be opened by a user on a system running the affected software. The CVSS 3.1 score of 7.8 (HIGH) reflects the requirement for user interaction but acknowledges the severity of the impact.

Business impact

A successful exploit results in denial of service against end users. Employees or contractors opening a malicious PDF will experience an application crash, disrupting their workflow. While confidentiality and integrity impacts are noted in the CVSS vector, the primary risk is availability. In environments where PDF review is common—legal, finance, engineering—widespread distribution of a malicious PDF could cause operational disruption. Additionally, attackers could leverage this to prevent users from accessing legitimate documents if embedded in email campaigns or shared repositories.

Affected systems

Foxit PDF Reader and Foxit PDF Editor are confirmed vulnerable. The vulnerability also affects Microsoft Windows systems hosting these applications. Organizations should inventory instances of Foxit PDF products across their environment, including both user workstations and shared systems. The Windows platform dependency is likely due to the underlying OS libraries used for memory management and rendering. Both consumer and enterprise deployments of Foxit software are in scope.

Exploitability

The vulnerability requires relatively low technical skill to exploit. An attacker needs only to craft a PDF with JavaScript that modifies the page structure—a capability well within reach of motivated threat actors. However, successful exploitation depends on social engineering: a user must be persuaded to open the malicious PDF. No network interaction is required, and no special privileges are needed. The user interaction requirement moderates the overall risk, but phishing campaigns, document sharing platforms, and compromised repositories could facilitate distribution. This is not currently tracked on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply security patches from Foxit Software and Microsoft as they become available. Consult vendor advisories for specific patch versions addressing CVE-2026-13127. Until patches are deployed, organizations should implement compensating controls: restrict JavaScript execution in PDF readers where business operations permit, disable thumbnail preview generation in Foxit settings, or limit PDF opening privileges to trusted documents. User awareness training emphasizing verification of PDF sources and suspicious behavior can reduce social engineering risk.

Patch guidance

Monitor Foxit Software's security advisory pages for patch releases for both PDF Reader and PDF Editor. Apply patches to all affected systems through your standard change management process. Prioritize systems where users regularly handle external PDFs or where PDF processing is mission-critical. Windows updates from Microsoft should be applied as part of routine patching cycles; verify that any PDF-related fixes are included. Before broad deployment, test patches in a controlled environment to ensure compatibility with line-of-business applications. Document patch application status for compliance and incident response purposes.

Detection guidance

Monitor for application crashes involving Foxit PDF products, particularly when preceded by recent PDF file access from external sources. Endpoint detection and response (EDR) tools should flag unexpected process termination of Foxit processes. Log JavaScript execution events within PDF readers if logging is available. Network indicators are minimal since this is a local attack, but email gateway logs can identify suspicious PDF attachments. Implement file analysis sandboxes to detonate PDFs and observe for crashes or malicious JavaScript execution patterns. User reports of 'PDF won't open' or 'program keeps crashing' should be escalated and the specific PDF file preserved for forensic analysis.

Why prioritize this

This vulnerability merits prompt but measured prioritization. The HIGH CVSS score (7.8) and local attack surface reflect genuine risk, but the user interaction requirement prevents it from being a systemic emergency. Organizations should patch within 30 days, accelerating to 14 days if Foxit products are heavily used or if exploitation attempts are detected in the wild. The absence of KEV status suggests active exploitation has not yet been confirmed at scale, but this does not guarantee future risk. Prioritize based on internal usage: environments with heavy PDF handling (legal, finance, design) should patch sooner than those with limited Foxit deployments.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a High-severity vulnerability with local attack vector (AV:L), low attack complexity (AC:L), and no privilege requirement (PR:N). User interaction is required (UI:R), which prevents a higher score. The impact assessment assigns High ratings to confidentiality (C:H), integrity (I:H), and availability (A:H), indicating that successful exploitation could theoretically affect all three security properties; in practice, denial of service dominates the observed impact. The local-only scope (S:U) limits blast radius but does not mitigate the severity when exploitation occurs.

Frequently asked questions