CVE-2026-13128 — Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

CVE-2026-13128

Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability PUBLISHED

Description (CNA)

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

Affected (CNA)

Vendor / product	Versions
Foxit Software Inc. / Foxit PDF Editor	affected Versions 2026.1.1 and earlier
Foxit Software Inc. / Foxit PDF Reader	affected Versions 2026.1.1 and earlier

CWE

CWE-416

References

https://www.foxit.com/support/security-bulletins.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.