CVE-2026-13129: Use-After-Free in Foxit PDF Editor & Reader Causes Denial of Service

Technical summary

CVE-2026-13129 is a use-after-free vulnerability (CWE-416) affecting PDF readers and editors. The root cause is improper validation of the PDF field tree structure. When JavaScript in the PDF processes field properties through a damaged tree, the application retains a stale object reference. Subsequent pointer dereference operations cause a NULL or invalid pointer read, triggering an unhandled exception. The vulnerability exists in the PDF parsing and JavaScript execution layers, affecting Foxit PDF Editor, Foxit PDF Reader, and Microsoft Windows environments where these applications run.

Business impact

This vulnerability enables denial of service attacks against users and organizations relying on PDF processing. An attacker can distribute a weaponized PDF that crashes the victim's application or system when opened. For organizations using Foxit products for secure document workflows, this could disrupt operations. Additionally, a crash event may indicate active exploitation attempts, warranting incident investigation. While the current reported impact is availability (crash), the high CVSS score reflects the potential for escalation in environments where the crash corrupts shared memory or triggers additional memory safety violations.

Affected systems

Foxit PDF Editor and Foxit PDF Reader are the primary affected products. The vulnerability also affects Microsoft Windows, likely because Windows is the execution environment and its memory management behavior influences exploitation. Verify exact version boundaries against Foxit's official security advisory; patch availability varies by product line (Editor vs. Reader) and release branch.

Exploitability

Exploitability is moderate to high. The attack requires local file access and user interaction (opening a PDF), which are common scenarios in office and knowledge-work environments. No special privileges are required to trigger the crash. The CVSS vector AV:L/AC:L/PR:N/UI:R indicates low complexity and no privilege escalation prerequisite. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting active exploitation has not been widely observed; however, the simplicity of crafting a malicious PDF makes opportunistic attacks probable.

Remediation

Organizations should prioritize patching Foxit PDF Editor and Foxit PDF Reader installations. Consult Foxit's security advisories to identify patched versions and deploy updates through your standard patch management process. For Microsoft Windows, apply any available cumulative updates relevant to PDF handling. Interim mitigations include restricting PDF file access from untrusted sources, disabling JavaScript execution in PDF readers if the application permits, and educating users not to open unsolicited PDF files.

Patch guidance

Contact Foxit for the specific patched versions of PDF Editor and PDF Reader that address CVE-2026-13129. Verify patch version numbers in the official Foxit security advisory before deployment. Microsoft Windows patches, if applicable, should be deployed as part of your regular patch cycle. Test patches in a non-production environment first to ensure compatibility with existing workflows.

Detection guidance

Monitor application crash logs and Windows Event Viewer for unexpected termination of Foxit PDF Editor or PDF Reader processes, particularly when correlated with file access events. Endpoint Detection and Response (EDR) solutions can flag suspicious PDF file creation or distribution. Network-level detection is limited since the attack is local; focus on endpoint telemetry. Consider implementing file integrity monitoring on shared PDF repositories to detect malicious modifications or unusual file creation timestamps.

Why prioritize this

This vulnerability merits high priority due to its high CVSS score (7.8), simplicity of exploitation, and widespread use of Foxit products in enterprise environments. The crash condition, while not enabling data exfiltration directly, can mask other attacks or be used for sabotage. Rapid patching across Foxit deployments is recommended to reduce the window of exposure, especially in organizations receiving PDFs from external parties.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local attack vector, low attack complexity, no privilege requirement, and user interaction (opening a PDF). The impact assessment covers all three pillars—confidentiality, integrity, and availability—reflecting that a crash can corrupt in-memory state, potentially exposing sensitive document content before termination, and denying service. The score does not presume remote exploitation; it is bounded to local scenarios.

Frequently asked questions