Foxit Software Inc. vulnerabilities, page 3

96 vulnerabilities

Known vulnerabilities in Foxit Software Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.

8.1HighCVE-2026-91812foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation VulnerabilityA vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.EPSS0.14%6.1MediumCVE-2026-91807foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityA heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.EPSS0.11%7.8HighCVE-2026-91797foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution VulnerabilityFoxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.EPSS0.21%7.8HighCVE-2026-91791foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityWhen processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.EPSS0.14%7.8HighCVE-2026-91799foxit software inc. · foxit pdf editor +3 moreFoxit Editor/Reader Array resetForm Use-After-Free VulnerabilityA use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.EPSS0.13%4.7MediumCVE-2026-91788foxit software inc. · foxit pdf editor +1 moreFoxit PDF Editor/Reader Missing Authorization Information Disclosure VulnerabilityWhen implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.EPSS0.10%8.8HighCVE-2026-91800foxit software inc. · foxit pdf editor +2 moreFoxit PDF Editor installer local privilege escalationA local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.EPSS0.10%7.8HighCVE-2026-13128foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution VulnerabilityEmbedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.EPSS0.17%7.8HighCVE-2026-13127foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityThe application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.EPSS0.17%7.8HighCVE-2026-13126foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityThe embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.EPSS0.17%7.8HighCVE-2026-13129foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityWhen the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.EPSS0.17%6.3MediumCVE-2026-1592foxit software inc. · pdfonline.foxit.com +1 moreStored XSS via Create New Layer Field found in Foxit PDF Editor CloudFoxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced. This issue affects pdfonline.foxit.com: before 2026‑02‑03.EPSS0.23%6.3MediumCVE-2026-1591foxit software inc. · pdfonline.foxit.com +1 moreStored XSS via Attachments Feature in https://pdfonline.foxit.com/Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed. This issue affects pdfonline.foxit.com: before 2026‑02‑03.EPSS0.23%7.1HighCVE-2026-4947foxit software inc. · na1.foxitesign.foxit.com +1 moreInsecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSignAddressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially leading to forged signatures and compromising the integrity and authenticity of documents undergoing the signing process. The issue was caused by insufficient authorization validation on referenced resources during request processing.EPSS0.29%8.5HighCVE-2026-18597foxit software inc. · foxit pdf services apiBlind SSRF on Foxit PDF Services APIThe PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.EPSS0.31%5.5MediumCVE-2026-18622foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as validFoxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of signatures.EPSS0.12%7.8HighCVE-2026-57238foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityAfter the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.EPSS0.17%6.1MediumCVE-2026-57257foxit software inc. · foxit pdf editor +3 moreSecurity vulnerability in Foxit PDF Editor/Reader — PRC 3D BRep Renderer Heap OOB ReadDuring the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the entity array. As a result, the application crashes.EPSS0.15%7.8HighCVE-2026-57260foxit software inc. · foxit pdf editor +3 moreSecurity vulnerability in Foxit PDF Editor/Reader — U3D Adobe Mesh Decompression (Type Confusion / Invalid Pointer Dereference)The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.EPSS0.17%7.8HighCVE-2026-57246foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Signature Buffer Overflow VulnerabilityWhen dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but the signature plugin does not perform validation when copying the abnormal string, causing the application to crash.EPSS0.17%