This vulnerability (CVE-2026-5939) in Foxit PDF Editor involves a use-after-free condition triggered by a specially crafted XFA PDF during the calculate event processing. This memory corruption can cause the application to crash and may allow an attacker to execute arbitrary code. The issue affects Foxit PDF Editor versions 2026.1 and earlier, and 14.0.3 and earlier. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, and impact limited to availability.

Successful exploitation can cause the Foxit PDF Editor application to crash, resulting in denial of service. Additionally, it may allow an attacker to execute arbitrary code within the context of the affected application. The impact does not include confidentiality or integrity loss according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted XFA PDF documents and consider restricting access to such files. Monitor Foxit Software Inc. advisories for updates and apply patches promptly once available.