CVE-2026-91791

Foxit PDF Editor and Reader contain a use-after-free flaw (CWE-416) that is triggered when the application processes a specially crafted PDF file. Malicious JavaScript inside the PDF causes a reentrant execution condition through page-visibility events, leading the app to access an already-freed page-view object while calculating annotation boundaries, producing an invalid memory read and a crash. Exploitation requires the victim to open a malicious PDF, so the flaw spreads primarily through phishing, malicious downloads, or booby-trapped documents. The described impact is at minimum an application crash (denial of service); the CVSS 3.1 vector also rates high confidentiality and integrity impact, which typically implies potential code execution, though only the memory-read/crash behavior is documented. There is no known public proof of concept and the issue is not in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been observed.

What to do: Update Foxit PDF Editor/Reader to the latest release and consult Foxit's security bulletin for the exact fixed build, since affected version ranges are not enumerated here. As a defense-in-depth measure, disable or restrict JavaScript execution for PDFs in Foxit's preferences, since the flaw depends on JavaScript embedded in the document. Remind users not to open PDFs from untrusted sources, and monitor for crash reports involving annotation rendering as an indicator of attempted exploitation.