CVE-2026-13128: Foxit PDF Use-After-Free Denial of Service Vulnerability

Technical summary

CVE-2026-13128 is a use-after-free vulnerability (CWE-416) in Foxit PDF Editor and PDF Reader. When a PDF file contains malicious JavaScript code, the script execution causes a page deletion within the document view. Subsequent scripts continue to reference properties of the deleted page object, leading to memory access violations and application crash. The vulnerability is triggered through normal PDF viewing without requiring elevated privileges, though user interaction is necessary to open the file.

Business impact

Organizations relying on Foxit PDF tools for document processing face potential workflow disruption if users open untrusted PDFs. While the vulnerability results in application crash rather than data theft, repeated exploitation could impact productivity and create a vector for social engineering attacks. In environments processing external documents (legal review, financial analysis, publishing), this could affect document handling pipelines.

Affected systems

Foxit PDF Editor and Foxit PDF Reader are the primary vulnerable applications. The vulnerability also affects Microsoft Windows systems running these products. Organizations using either Foxit product to view or edit PDF documents should assess their exposure, particularly if they handle PDFs from external or untrusted sources.

Exploitability

This vulnerability requires moderate effort to exploit. An attacker must craft a PDF file with specific JavaScript payloads designed to trigger page deletion and subsequent memory corruption. The attack requires user interaction—specifically, a user must open the malicious PDF file. No network access or authentication is required. The straightforward nature of the attack vector (opening a file) makes it practical for targeted distribution via email or file-sharing platforms.

Remediation

Apply security updates from Foxit for both PDF Editor and PDF Reader when available. Verify patch version numbers against official Foxit security advisories. Until patched, implement controls to restrict PDF handling: disable JavaScript execution in PDF readers where feasible, use sandboxed viewing environments for untrusted PDFs, and educate users about opening files from unknown sources. Consider alternative PDF readers with stronger security postures for high-risk document processing.

Patch guidance

Contact Foxit directly or check their security advisory portal for patched versions of PDF Editor and PDF Reader. Apply updates to all affected systems. Testing should include verification that JavaScript-enabled PDFs function correctly post-patch and that malicious PDFs no longer trigger crashes. Document patching timelines and communicate remediation status to stakeholders dependent on these tools.

Detection guidance

Monitor for application crashes in Foxit PDF Editor and PDF Reader, particularly when correlated with PDF file access from external sources. Endpoint Detection and Response (EDR) solutions can flag repeated crashes or memory corruption patterns. Review PDF files from untrusted sources for embedded JavaScript before opening; static analysis tools can identify JavaScript payloads. Logs from PDF application errors may contain stack traces pointing to document view memory issues.

Why prioritize this

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local attack vector, low complexity, no privilege requirement, and potential for high impact across confidentiality, integrity, and availability. While the primary impact is denial of service, the ease of exploitation and applicability to common PDF workflows warrant prompt patching. Organizations handling external documents should prioritize this remediation.

Risk score, explained

The severity rating is driven by multiple factors: (1) low barriers to exploitation—crafting a malicious PDF is straightforward; (2) high user interaction likelihood—PDFs are ubiquitous in business communication; (3) no privilege escalation required; and (4) complete application unavailability upon crash. The local attack vector and requirement for user interaction prevent a critical score, but the confluence of practical exploitability and business disruption potential justifies the HIGH severity classification.

Frequently asked questions