ZDI-26-722: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Editor and Reader contain a use-after-free flaw (CWE-416) that is triggered when the application processes a specially crafted PDF file. Malicious JavaScript inside the PDF causes a reentrant execution condition through page-visibility events, leading the app to access an already-freed page-view object while calculating annotation boundaries, producing an invalid memory read and a crash. Exploitation requires the victim to open a malicious PDF, so the flaw spreads primarily through phishing, malicious downloads, or booby-trapped documents. The described impact is at minimum an application crash (denial of service); the CVSS 3.1 vector also rates high confidentiality and integrity impact, which typically implies potential code execution, though only the memory-read/crash behavior is documented. There is no known public proof of concept and the issue is not in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been observed.