ZDI-26-738: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
ZDI discloses a Foxit PDF Reader annotation use-after-free that can leak data if a user opens a malicious file.
20
CVE-2026-91809
Use-after-free in Foxit PDF Editor/Reader form field handling
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free vulnerability exists in Foxit PDF Editor/Reader when malformed PDF form fields are handled. Improper validation during field-name traversal can cause the application to access a released object, leading to an application crash. An attacker could potentially gain unauthorized access or other privileges, but no public exploit is currently known. The vulnerability affects Foxit PDF Editor/Reader across all relevant versions, though specific version ranges are not provided in the data.
What to do: Upgrade to patched versions of Foxit PDF Editor/Reader. Implement strict input validation and secure field handling. Regularly scan for exposed installations and monitor for anomalous usage.
| Product | Affected |
|---|---|
| Foxit PDF Editor/Reader | Patched versions (no specific version range provided in data) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H