The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.
When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.
Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.
Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.
CVE-2026-5940 is a use-after-free vulnerability in Foxit PDF Editor versions 2026.1 and earlier, 14.0.3 and earlier, and 13.2.3 and earlier. The flaw occurs when a UI refresh is triggered after comments are removed via a script, potentially causing the program to access invalid memory and crash. This vulnerability has a high severity with a CVSS score of 7.8. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5942 is a use-after-free vulnerability in Foxit PDF Editor affecting versions 2026.1 and earlier, 14.0.3 and earlier, and 13.2.3 and earlier. The flaw arises from improper page lifecycle management, which causes document structure changes to desynchronize internal component states. This desynchronization leads to subsequent operations accessing invalidated objects, resulting in application crashes. The vulnerability has a CVSS 3.1 base score of 5.
CVE-2026-5943 is a use-after-free vulnerability in Foxit PDF Editor affecting multiple versions up to 2026.1, 14.0.3, and 13.2.3. The flaw occurs due to inconsistencies between page element relationships and internal index states when document structural anomalies are present. This leads to invalid pointer access during page information queries triggered by document modifications, causing application crashes. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-5939 is a use-after-free vulnerability in Foxit PDF Editor affecting versions 2026.1 and earlier, and 14.0.3 and earlier. It occurs when processing a crafted XFA PDF during a calculate event, which can cause the application to crash and potentially allow arbitrary code execution. The vulnerability has a medium severity with a CVSS score of 5.5. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-5941 is a high-severity vulnerability in Foxit PDF Editor affecting versions 2026.1 and earlier, and 14.0.3 and earlier. It involves improper input validation in the parsing logic, where malformed form field hierarchies cause non-signature data to be misidentified as valid signatures. This results in invalid memory writes and program crashes during internal data structure construction. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. The product is a cloud service, and a patch is available. There are no known exploits in the wild at this time.
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
CVE-2026-3774 is a medium severity vulnerability in Foxit PDF Editor versions 2025.3 and earlier. It involves the application's handling of PDF JavaScript and document/print actions that update form fields, annotations, or optional content groups immediately before or after redaction, encryption, or printing. These updates are not fully accounted for by the redaction, encryption, and printing logic, which may cause small amounts of sensitive content to remain visible or unencrypted, or cause printed output to differ slightly from the on-screen review. There are no known exploits in the wild and no patch information is provided.
CVE-2026-3775 is a high-severity DLL hijacking vulnerability affecting Foxit PDF Editor versions 2025.3 and earlier. The vulnerability arises because the application's update service loads system libraries from search paths that include directories writable by low-privileged users. This allows a local attacker to place a malicious DLL in such a directory, which the update service then loads with SYSTEM privileges, leading to local privilege escalation and arbitrary code execution. There is currently no official patch or remediation available from the vendor, and no known exploits have been reported in the wild.
CVE-2026-3776 is a medium severity vulnerability in Foxit PDF Editor affecting versions 2025.3 and earlier, 14.0.2 and earlier, and 13.2.2 and earlier. The flaw arises because the application does not verify the presence of required appearance (AP) data before accessing stamp annotation resources in a PDF. If a crafted PDF contains a stamp annotation missing its AP entry, the application dereferences a null pointer, causing a crash and resulting in denial of service. There is no indication of data confidentiality or integrity impact. No patch or official fix information is currently provided.
CVE-2026-3780 is a high-severity vulnerability in Foxit PDF Reader versions 2025.3 and earlier. The installer runs with elevated privileges but uses untrusted search paths to resolve system executables and DLLs, which may include user-writable directories. This allows a local attacker to place malicious binaries with the same names as legitimate system files, causing the installer to load or execute the malicious files instead. This results in local privilege escalation. No patch or official fix information is currently available.
CVE-2026-3778 is a medium severity vulnerability in Foxit PDF Editor affecting versions 2025.3 and earlier, 14.0.2 and earlier, and 13.2.2 and earlier. The application fails to detect cyclic references in PDF JavaScript objects, which can lead to uncontrolled recursion when processing documents with cyclic page and annotation references. This recursion can cause stack exhaustion and crash the application. There is no indication of confidentiality or integrity impact, and no known exploits are reported. Patch status is not confirmed as no official fix or patch links are provided.
CVE-2026-3779 is a use-after-free vulnerability in Foxit PDF Editor affecting versions 2025.3 and earlier, 14.0.2 and earlier, and 13.2.2 and earlier. The issue arises because the application's list box calculation logic retains stale references to page or form objects after they have been deleted or recreated. This flaw can be triggered by specially crafted documents, potentially leading to arbitrary code execution when the calculation runs. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-3777 is a use-after-free vulnerability in Foxit PDF Editor affecting versions 2025.3 and earlier, 14.0.2 and earlier, and 13.2.2 and earlier. The issue arises when JavaScript modifies the document zoom and triggers a page change, causing stale internal view cache pointers to be dereferenced after the original view object is destroyed. This can potentially lead to arbitrary code execution. The vulnerability has a medium severity with a CVSS score of 5.5.
CVE-2026-4947 is an improper access control vulnerability in Foxit Software Inc. 's na1.foxitesign.foxit.com affecting versions before 2026-03-26. It involves an insecure direct object reference (IDOR) in the signing invitation acceptance process, where insufficient authorization validation allowed attackers to manipulate object identifiers to access or modify unauthorized resources. This could lead to forged signatures, compromising document integrity and authenticity. The vulnerability has a high severity with a CVSS score of 7.1. No known exploits are reported in the wild.
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.
This issue affects pdfonline.foxit.com: before 2026‑02‑03.
CVE-2026-1591 is a stored cross-site scripting (XSS) vulnerability in Foxit PDF Editor Cloud's file upload feature (pdfonline.foxit.com) affecting versions before 2026-02-03. The vulnerability arises because malicious usernames embedded in uploaded file lists are not properly escaped, allowing arbitrary JavaScript execution when the list is viewed. Exploitation requires authenticated access and some user interaction, with a medium severity CVSS score of 6.3. While no known exploits are currently in the wild, successful attacks could lead to theft of sensitive information or session hijacking. European organizations using this cloud-based PDF editor should prioritize patching or mitigating this vulnerability to prevent potential client-side attacks. Countries with high adoption of Foxit products and significant cloud service usage, such as Germany, France, and the UK, are most likely to be affected. Mitigation includes applying vendor patches when available, restricting user input, and employing Content Security Policies to limit script execution.
