ZDI-26-744: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed a Foxit PDF Reader AcroForm use-after-free enabling remote code execution via a malicious file.
48
CVE-2026-91816
Use-after-free in Foxit PDF Editor/Reader with Reentrant Annotation Deletion Triggered by Embedded JavaScript
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free vulnerability exists in Foxit PDF Editor/Reader where reentrant annotation deletion caused by embedded JavaScript can lead to accessing a released annotation object, resulting in a crash. This flaw is triggered by specific reentrant annotation deletion scenarios involving embedded JavaScript. An attacker could potentially gain unauthorized access or other privileges through this vulnerability. The affected scope is limited to Foxit PDF Editor/Reader, though the exact affected version range is not specified.
What to do: Upgrade to the latest version of Foxit PDF Editor/Reader to mitigate the use-after-free vulnerability. Implement strict access controls and secure memory management to prevent reentrant annotation deletion. Monitor for CVE-2026-91816 and related patches to ensure full security mitigation.
| Product | Affected |
|---|---|
| Foxit PDF Editor/Reader | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H