ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.
ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.
- Use-after-free in Foxit PDF Reader annotation handling allows remote arbitrary code execution
- Requires user interaction: target must open a malicious file or visit a malicious page
- Tracked as CVE-2026-13126 with CVSS 7.8
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-13126 | The embedded JavaScript in the PDF deleted the pages, making the object invalid. The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing. NVD description · AI analysis pending | 7.8 | <1% |
| — |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-13126.
This source does not provide full text. Read it at zerodayinitiative.com.