CVE-2026-13128

HIGH

Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

Title source: cna

Description

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

References (1)

Core 1

Core References

https://www.foxit.com/support/security-bulletins.html

Scores

CVSS v3 7.8

EPSS 0.0012

EPSS Percentile 1.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-416

Status published

Products (4)

foxit/pdf_editor < 13.2.4.24048

foxit/pdf_reader < 2026.1.1.36485

Foxit Software Inc./Foxit PDF Editor Versions 2026.1.1 and earlier

Foxit Software Inc./Foxit PDF Reader Versions 2026.1.1 and earlier

Published Jul 08, 2026

Tracked Since Jul 08, 2026