ZDI-26-746: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
A second Foxit PDF Reader annotation use-after-free can allow remote code execution with user interaction (CVE-2026-91818).
ZDI-26-746 covers another annotation use-after-free in Foxit PDF Reader that allows remote code execution if a user opens a malicious file or visits a malicious page. ZDI rated it CVSS 7.8 and assigned CVE-2026-91818. The published advisory does not describe observed exploitation.
- Separate annotation use-after-free can yield remote code execution.
- Exploitation needs the user to open a file or visit a page.
- CVSS 7.8 and CVE-2026-91818 are assigned by ZDI.
- The advisory does not state in-the-wild exploitation.
- CVEs
- CVE-2026-91818
- Vendors
- Foxit
- Products
- Foxit PDF Reader
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91818 | Use-After-Free in Foxit PDF Editor/Reader Annotations (CVE-2026-91818) | 5.5 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.