CVE-2026-5943: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-5943 is a Use After Free (CWE-416) vulnerability in Foxit PDF Reader and Foxit PDF Editor that allows an attacker to crash the application — and potentially execute arbitrary code — by enticing a user to open a specially crafted PDF file. The flaw stems from document structural anomalies that cause inconsistencies between page element relationships and internal index states; when scripts trigger document modifications, object reference validity is not properly maintained, leading to access of an invalid pointer during page information queries. Affected versions include Foxit PDF Editor 14.0.0–14.0.3, 13.x prior to 13.2.4, and 2023.x/2026.x prior to 2026.1.1, as well as Foxit PDF Reader prior to 2026.1.1. The vulnerability was published on April 27, 2026, with a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Foxit Security Bulletins).

The root cause is a Use After Free condition (CWE-416) in the handling of Annotation objects within Foxit's PDF rendering engine. When a PDF document contains structural anomalies and embedded JavaScript triggers modifications to document elements (such as adding or removing pages or annotations), the application fails to properly validate object references before use, resulting in a dangling pointer being accessed during subsequent page information queries. Exploitation requires local access and user interaction — specifically, a victim must open a malicious PDF file — but no privileges are required. The Zero Day Initiative advisory (ZDI-26-304) provides additional details on the specific flaw within Annotation object handling (ZDI Advisory, GitHub Advisory).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected system. At minimum, an attacker can crash the Foxit PDF Reader or PDF Editor application (denial of service); in a worst-case scenario, the use-after-free condition could be leveraged to achieve arbitrary code execution in the context of the current user. Because the attack vector is local and requires user interaction (opening a malicious PDF), the scope is limited to the affected workstation, though code execution could enable further lateral movement or data exfiltration (GitHub Advisory, ZDI Advisory).

No confirmed public exploit code or in-the-wild exploitation has been observed as of the time of reporting. The ZDI advisory (ZDI-26-304) documents the vulnerability details and disclosure timeline but does not include exploit code or reproduction steps. The EPSS score is approximately 0.013–0.015%, placing it in the 4th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures are available via Nessus (plugin 310407) and Qualys (detection ID 387163) (ZDI Advisory, GitHub Advisory).

1. Craft a malicious PDF: Create a PDF document containing structural anomalies (e.g., inconsistent page element relationships or malformed cross-reference tables) combined with embedded JavaScript that triggers document modifications such as adding, removing, or reordering pages or annotations after the document is loaded.
2. Deliver the malicious PDF: Distribute the crafted PDF to a target user via email attachment, web download, or other social engineering means, relying on the user to open it in Foxit PDF Reader or PDF Editor.
3. Trigger the vulnerability: When the victim opens the PDF, the embedded JavaScript executes and modifies document elements. The application fails to invalidate or update object references, leaving a dangling pointer to a freed Annotation object.
4. Access the invalid pointer: A subsequent page information query (e.g., triggered by the script or normal rendering) accesses the freed memory, causing a crash (denial of service) or, if memory has been reclaimed and controlled by the attacker, potentially enabling arbitrary code execution in the context of the victim user (ZDI Advisory, GitHub Advisory).

• File System: Unexpected or suspicious PDF files received via email or downloaded from untrusted sources; PDF files containing embedded JavaScript with document modification calls (e.g., doc.deletePages, doc.insertPages, annotation manipulation APIs).
• Process: Foxit PDF Reader or PDF Editor process (FoxitPDFReader.exe, FoxitPDFEditor.exe) crashing unexpectedly or generating crash dump files (.dmp) in %LOCALAPPDATA%\CrashDumps or the application's temp directory.
• Logs: Windows Event Log entries (Application log) showing application crash events for Foxit processes with faulting module references; Dr. Watson or Windows Error Reporting logs referencing Foxit executables.
• Network: Outbound connections from Foxit processes to unexpected external IP addresses or domains (potential indicator of code execution beyond a simple crash).

Foxit has released patched versions addressing this vulnerability. Users should update to the following fixed versions:

• Foxit PDF Reader: Update to version 2026.1.1 or later.
• Foxit PDF Editor (14.0.x branch): Update to version 14.0.4 or later.
• Foxit PDF Editor (2023.x / 2026.x branches): Update to version 2026.1.1 or later.
• Foxit PDF Editor (13.x and earlier): Update to version 13.2.4 or later.

As interim workarounds, avoid opening PDF files from untrusted or unknown sources, and consider disabling JavaScript execution within PDF documents if not required for business operations (Foxit Security Bulletins, GitHub Advisory).

Heise (a German technology news outlet) covered the vulnerability as part of broader reporting on malicious code vulnerabilities threatening Foxit PDF Reader and PDF Editor (Heise News). The Zero Day Initiative published advisory ZDI-26-304 documenting the flaw, consistent with their coordinated disclosure process with Foxit (ZDI Advisory). No significant social media controversy or notable researcher commentary beyond standard disclosure activity has been observed.