CVE-2026-13128

—

CVSS 3.1

7.8 high

EPSS

<1%p7

Published

Jul 8, 2026 (Jul 8, 2026)

Modified

Jul 9, 2026

Description

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

Vendors: foxit
Products: pdf editor, pdf reader
Weakness: CWE-416
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news1 stories

ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a use-after-free in Foxit PDF Reader (CVE-2026-13128) enabling remote code execution when a user opens a malicious file.

Zero Day Initiative advisory ZDI-26-602 describes a use-after-free flaw in Foxit PDF Reader's document object handling. Exploitation yields arbitrary code execution but requires the target to open a malicious page or file. ZDI assigned CVSS 7.8 and CVE-2026-13128. The advisory does not report active exploitation.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-13128