This vulnerability (CVE-2026-5940) in Foxit PDF Editor involves a use-after-free condition (CWE-416) triggered by calling a function that refreshes the user interface after comments are removed through scripting. This leads to access of an invalidated object, resulting in program crashes. The affected versions include 2026.1 and earlier, 14.0.3 and earlier, and 13.2.3 and earlier. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can cause the Foxit PDF Editor application to crash due to use-after-free memory access. The impact includes potential denial of service and possible compromise of confidentiality, integrity, and availability of the application process. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid executing scripts that remove comments triggering UI refreshes in affected versions. Monitor Foxit Software Inc. advisories for updates and apply patches promptly once available.