Story · 1 source · 14 articlesfirst Sep 23, 05:00 UTCupdated Sep 23, 05:00 UTC (4d ago)

ZDI discloses 10 Foxit PDF Reader vulnerabilities: six CVSS 7.8 remote code execution flaws and four CVSS 3.3 information disclosure use-after-frees

highVulnerabilityimportance 52CVE-2026-91817 CVE-2026-91818 CVE-2026-91791 CVE-2026-91816 CVE-2026-91792 CVE-2026-13128 CVE-2026-91806 CVE-2026-91793

What's new: Initial merged summary (no previous story summary existed). This is the first consolidation of the ten newly published ZDI advisories dated 2026-09-23 — ZDI-26-722, ZDI-26-724, ZDI-26-725, ZDI-26-726, ZDI-26-727, ZDI-26-729, ZDI-26-735, ZDI-26-744, ZDI-26-745 and ZDI-26-746 — into a single Foxit PDF Reader story covering six RCE and four information-disclosure flaws.

Merged summary · glm-5.3 · rewritten as coverage arrives

On 2026-09-23 Trend Micro's Zero Day Initiative published 10 advisories for Foxit PDF Reader: six remote code execution bugs rated CVSS 7.8 (one AcroForm out-of-bounds read and five use-after-frees in AcroForm and annotation handling) plus four CVSS 3.3 Doc…

Trend Micro's Zero Day Initiative published ten advisories on 2026-09-23 covering memory-safety flaws in Foxit PDF Reader. Six are rated CVSS 7.8 and allow remote code execution: ZDI-26-745 (CVE-2026-91817), an AcroForm out-of-bounds read; ZDI-26-744 (CVE-2026-91816), an AcroForm use-after-free; and four annotation use-after-frees — ZDI-26-722 (CVE-2026-91791), ZDI-26-724 (CVE-2026-91792), ZDI-26-727 (CVE-2026-13128) and ZDI-26-746 (CVE-2026-91818). The remaining four are Doc object use-after-frees rated CVSS 3.3 that can disclose sensitive information to a remote attacker: ZDI-26-725 (CVE-2026-57256), ZDI-26-726 (CVE-2026-13129), ZDI-26-729 (CVE-2026-91793) and ZDI-26-735 (CVE-2026-91806). Every advisory states that exploitation requires the victim to open a malicious file or visit a malicious page, meaning user interaction is needed in all cases. None of the ten advisories reports observed in-the-wild exploitation, and the notices do not state affected product versions or patch status. The reports are mutually consistent; no source disagreements were identified.

Ten ZDI advisories for Foxit PDF Reader were published on 2026-09-23 by Trend Micro's Zero Day Initiative.
Six flaws are rated CVSS 7.8 and classified as remote code execution: ZDI-26-745 / CVE-2026-91817 (AcroForm out-of-bounds read), ZDI-26-744 / CVE-2026-91816 (AcroForm use-after-free), ZDI-26-722 / CVE-2026-91791, ZDI-26-724 /…
Four flaws are Doc object use-after-frees rated CVSS 3.3 that can disclose sensitive information: ZDI-26-725 / CVE-2026-57256, ZDI-26-726 / CVE-2026-13129, ZDI-26-729 / CVE-2026-91793 and ZDI-26-735 / CVE-2026-91806.
All ten vulnerabilities require user interaction: the victim must open a malicious file or visit a malicious page.
None of the ten advisories states that any of the flaws is being exploited in the wild.
The advisories do not specify affected Foxit PDF Reader versions or remediation status.

VendorsFoxit

ProductsFoxit PDF Reader

OrganizationsZero Day Initiative

Coverage timelineoldest first · each row is one article

Sep 23, 05:00 UTC · 4d ago
ZDI Published Advisories· 52
ZDI-26-745: Foxit PDF Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
Foxit PDF Reader AcroForm out-of-bounds read may allow remote code execution with user interaction.
Sep 23, 05:00 UTC · 4d ago
ZDI Published Advisories· 24
ZDI-26-725: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
ZDI disclosed another Foxit PDF Reader use-after-free information-disclosure flaw, CVE-2026-57256.
Sep 23, 05:00 UTC · 4d ago
ZDI Published Advisories· 24
ZDI-26-726: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability

Vulnerabilities in this storyAll →

CVE-2026-572567.8<1%
When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form…
published Jul 8, 2026· foxit pdf editor+3 related
CVE-2026-917917.8—
Use-After-Free in Foxit PDF Editor/Reader via Crafted PDF JavaScript
published

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-57256 +3 related CVEs CVE-2026-13129 CVE-2026-57238 CVE-2026-13128	When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form… When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash. NVD description · AI analysis pending	7.8	<1%		foxit pdf editor foxit pdf reader	—	Jul 8, 2026
CVE-2026-91791 +7 related CVEs CVE-2026-91792 CVE-2026-91793 CVE-2026-91806 CVE-2026-91816 CVE-2026-91818 CVE-2026-91810 CVE-2026-91817	Use-After-Free in Foxit PDF Editor/Reader via Crafted PDF JavaScript Foxit PDF Editor and Reader contain a use-after-free flaw (CWE-416) that is triggered when the application processes a specially crafted PDF file. Malicious JavaScript inside the PDF causes a reentrant execution condition through page-visibility events, leading the app to access an already-freed page-view object while calculating annotation boundaries, producing an invalid memory read and a crash. Exploitation requires the victim to open a malicious PDF, so the flaw spreads primarily through phishing, malicious downloads, or booby-trapped documents. The described impact is at minimum an application crash (denial of service); the CVSS 3.1 vector also rates high confidentiality and integrity impact, which typically implies potential code execution, though only the memory-read/crash behavior is documented. There is no known public proof of concept and the issue is not in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been observed. Do: Update Foxit PDF Editor/Reader to the latest release and consult Foxit's security bulletin for the exact fixed build, since affected version ranges are not enumerated here. As a defense-in-depth measure, disable or restrict JavaScript execution for PDFs in Foxit's preferences, since the flaw depends on JavaScript embedded in the document. Remind users not to open PDFs from untrusted sources, and monitor for crash reports involving annotation rendering as an indicator of attempted exploitation.	7.8 group max	—		Foxit PDF Editor Foxit PDF Reader	massPlausibly tens of millions of desktop installations (order of 10M+), clearly an estimate	3d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-57256

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form…

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash.

NVD description · AI analysis pending

7.8

<1%

foxit pdf editor
foxit pdf reader

—

Jul 8, 2026

CVE-2026-91791

Use-After-Free in Foxit PDF Editor/Reader via Crafted PDF JavaScript

Foxit PDF Editor and Reader contain a use-after-free flaw (CWE-416) that is triggered when the application processes a specially crafted PDF file. Malicious JavaScript inside the PDF causes a reentrant execution condition through page-visibility events, leading the app to access an already-freed page-view object while calculating annotation boundaries, producing an invalid memory read and a crash. Exploitation requires the victim to open a malicious PDF, so the flaw spreads primarily through phishing, malicious downloads, or booby-trapped documents. The described impact is at minimum an application crash (denial of service); the CVSS 3.1 vector also rates high confidentiality and integrity impact, which typically implies potential code execution, though only the memory-read/crash behavior is documented. There is no known public proof of concept and the issue is not in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been observed.

Do: Update Foxit PDF Editor/Reader to the latest release and consult Foxit's security bulletin for the exact fixed build, since affected version ranges are not enumerated here. As a defense-in-depth measure, disable or restrict JavaScript execution for PDFs in Foxit's preferences, since the flaw depends on JavaScript embedded in the document. Remind users not to open PDFs from untrusted sources, and monitor for crash reports involving annotation rendering as an indicator of attempted exploitation.

7.8

group max

—

Foxit PDF Editor
Foxit PDF Reader

massPlausibly tens of millions of desktop installations (order of 10M+), clearly an estimate

3d ago