CVE-2026-91818: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-91818 is a use-after-free (UAF) vulnerability in Foxit PDF Editor and Foxit PDF Reader's JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash. Affected versions include Foxit PDF Editor 2026.2 and earlier, 14.0.7 and earlier, and 13.2.6 and earlier, as well as Foxit PDF Reader 2026.2 and earlier. The vulnerability was published on September 23, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Foxit Security Bulletins).

The vulnerability is classified as CWE-416 (Use After Free). During JavaScript-driven enumeration of PDF annotations, reentrant page-event processing can cause the associated page object to be freed prematurely; subsequent access to that freed memory region triggers the vulnerability. Exploitation requires local access and user interaction — specifically, a victim must open a specially crafted malicious PDF file. The attack vector is local (AV:L), with low complexity and no privileges required, but user interaction is necessary (GitHub Advisory, Foxit Security Bulletins).

Successful exploitation results in an application crash (denial of service) at minimum, with the CVSS scoring also reflecting high confidentiality, integrity, and availability impacts — suggesting potential for memory corruption beyond a simple crash, which could theoretically be leveraged for arbitrary code execution. An unauthenticated local user can trigger this condition without elevated privileges by opening a crafted PDF. The scope is limited to the affected application and does not extend to other system components (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.17%, indicating a low near-term probability of exploitation. NVD SSVC assessment notes the vulnerability is not automatable and requires user interaction (GitHub Advisory, Foxit Security Bulletins).

1. Craft a malicious PDF: Create a PDF document containing JavaScript that triggers reentrant page-event processing during annotation enumeration, causing the page object to be freed while still referenced.
2. Deliver the file: Distribute the crafted PDF to a target user via email, web download, or other social engineering means.
3. User opens the file: The victim opens the malicious PDF in a vulnerable version of Foxit PDF Editor or Foxit PDF Reader (≤2026.2, ≤14.0.7, or ≤13.2.6 for Editor).
4. Trigger the UAF condition: The embedded JavaScript executes, causing annotation enumeration to invoke page-event callbacks that free the page object mid-enumeration.
5. Application crash or code execution: The freed memory is subsequently accessed, resulting in a use-after-free condition that crashes the application and may, under the right memory layout, enable arbitrary code execution (GitHub Advisory).

• File System: Unexpected or suspicious PDF files received from unknown sources, particularly those containing embedded JavaScript targeting annotation events.
• Logs: Application crash logs or Windows Error Reporting (WER) entries referencing Foxit PDF Editor or Foxit PDF Reader processes crashing during PDF rendering or JavaScript execution.
• Process: Foxit PDF Editor/Reader process terminating abnormally (access violation or heap corruption) shortly after opening a PDF file; child processes spawned unexpectedly from the Foxit process if exploitation progresses beyond a crash.

Users should update Foxit PDF Reader to a version newer than 2026.2, and Foxit PDF Editor to a version newer than 2026.2, 14.0.7, or 13.2.6 (depending on the installed branch). As a workaround, users should exercise caution when opening PDF files from untrusted sources and consider disabling JavaScript execution within PDF documents if the application provides that option. Patches were made available by Foxit on September 23, 2026 (Foxit Security Bulletins, GitHub Advisory).