This vulnerability (CVE-2026-5940) involves a use-after-free condition in Foxit PDF Editor. Specifically, when comments are removed through scripting, a subsequent UI refresh may access an object that has already been freed, leading to potential program crashes. It affects multiple versions of Foxit PDF Editor up to 2026.1, 14.0.3, and 13.2.3. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. There is no known exploit in the wild and no official patch or remediation guidance has been published by Foxit Software Inc. as of the publication date.

Successful exploitation can cause program crashes due to use-after-free memory access, potentially leading to denial of service and high impact on confidentiality, integrity, and availability of the affected application. No known exploits are reported in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Users should monitor Foxit Software Inc. advisories for updates. Until a fix is released, avoid running untrusted scripts that remove comments or trigger UI refreshes in affected versions of Foxit PDF Editor.