ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.
ZDI-26-603 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13127 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
- Use-after-free in annotation handling enables arbitrary remote code execution
- CVSS 7.8; user interaction is required for exploitation
- CVE-2026-13127; no in-the-wild exploitation reported
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-13127 | The application opens the PDF file. The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash. NVD description · AI analysis pending | 7.8 | <1% |
| — |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-13127.
This source does not provide full text. Read it at zerodayinitiative.com.