Foxit Software Inc. vulnerabilities, page 5
96 vulnerabilities
Known vulnerabilities in Foxit Software Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
HighCVE-2026-5941foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader AcroForm Signature Remote Code Execution VulnerabilityParsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.EPSS0.16%HighCVE-2026-5940foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution VulnerabilityCalling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.EPSS0.16%MediumCVE-2026-5942foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader AcroForm Signature Use-After-Free VulnerabilityFlaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.EPSS0.15%HighCVE-2026-5943foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution VulnerabilityDocument structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.EPSS0.17%MediumCVE-2026-5937foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerabilityInsufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.EPSS0.15%MediumCVE-2026-5939foxit software inc. · foxit pdf editor +3 moreUAF in Foxit PDF Editor/Reader via XFA calculate eventA crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.EPSS0.16%CriticalCVE-2026-5936foxit software inc. · foxit pdf services api +1 moreServer-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services APIAn attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.EPSS0.34%MediumCVE-2026-5938foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Infinite Loop Denial-of-Service VulnerabilityImproper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.EPSS0.15%HighCVE-2026-12057foxit software inc. · foxit ai +1 moreDoS + Remote Code Execution via PDF JavaScript in Foxit AIWhen the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.EPSS0.13%HighCVE-2026-3777foxit software inc. · foxit pdf editor +3 moreUse after free of view cache in Foxit PDF Editor/ReaderThe application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.EPSS0.17%HighCVE-2026-3774foxit software inc. · foxit pdf editor +2 moreSelf-Modifications Affecting Altered Printing and Redaction in Foxit PDF EditorThe application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redaction, encryption, or printing. These script‑driven updates are not fully covered by the existing redaction, encryption, and printing logic, which, under specific document structures and user workflows, may cause a small amount of sensitive content to remain unremoved or unencrypted as expected, or result in printed output that slightly differs from what was reviewed on screen.EPSS0.18%HighCVE-2026-3775foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityThe application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.EPSS0.19%MediumCVE-2026-3776foxit software inc. · foxit pdf editor +3 moreNull pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotationThe application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.EPSS0.15%MediumCVE-2026-3778foxit software inc. · foxit pdf editor +3 moreStack exhaustion caused by cyclic references in Foxit PDF Editor/ReaderThe application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.EPSS0.15%HighCVE-2026-3779foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader List Box Calculate Array Use-After-Free VulnerabilityThe application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary code execution.EPSS0.22%HighCVE-2026-3780foxit software inc. · foxit pdf editor +3 moreFoxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege EscalationThe application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation.EPSS0.17%