60
CVE-2026-13126
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p7
- Published
- ·
- Modified
Description · NVD
The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news
2 storiesZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.
25