CVE-2026-13127

HIGH7.8

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Published Jul 8, 2026

Modified 3 months ago

Details

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.

Affected Packages

Foxit PDF Editor

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Foxit PDF Reader

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Foxit Reader

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

福昕高级PDF编辑器

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-13127