CVE-2026-5940

HIGH

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Title source: cna
STIX 2.1

Description

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

References (1)

Scores

CVSS v3 7.8
EPSS 0.0001
EPSS Percentile 2.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-416
Status published
Products (6)
foxit/pdf_editor < 13.2.4
foxit/pdf_reader < 2026.1.1
Foxit Software Inc./Foxit PDF Editor Versions 13.2.3 and earlier
Foxit Software Inc./Foxit PDF Editor Versions 14.0.3 and earlier
Foxit Software Inc./Foxit PDF Editor Versions 2026.1 and earlier
Foxit Software Inc./Foxit PDF Reader Versions 2026.1 and earlier
Published Apr 27, 2026
Tracked Since Apr 27, 2026