CVE-2026-13127

CVSS 3.1: 7.8 high
EPSS: <1%p7
Published: Jul 8, 2026 · Jul 8, 2026
Modified: Jul 9, 2026

Analyze CVE-2026-13127 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.

Vendors: foxit

Products: pdf editor, pdf reader

Weakness: CWE-416

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news

1 story

ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.

ZDI Published AdvisoriesAug 24, 05:00 UTC · Aug 24, 2026VulnerabilityCVE-2026-131272