CVE-2026-13126: Foxit PDF Editor DOS Vulnerability

CVE-2026-13126 Overview

CVE-2026-13126 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. Embedded JavaScript inside a crafted PDF deletes pages, invalidating the underlying object. The application then attempts to write to invalid pop-up annotations, triggering a crash and potential code execution. Exploitation requires a local user to open a malicious PDF document.

Critical Impact
An attacker can achieve arbitrary code execution in the context of the current user by tricking a victim into opening a specially crafted PDF that abuses JavaScript-driven page deletion.

Affected Products

Foxit PDF Editor on Microsoft Windows
Foxit PDF Reader on Microsoft Windows
Microsoft Windows host operating system

Discovery Timeline

2026-07-08 - CVE-2026-13126 published to the National Vulnerability Database
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-13126

Vulnerability Analysis

The flaw is a use-after-free condition triggered through the PDF JavaScript engine in Foxit PDF Editor and Reader. When a PDF containing embedded JavaScript executes a page deletion routine, the parent page object and its associated annotations are freed. The application does not correctly invalidate the references held by dependent pop-up annotation objects. A subsequent write operation on these dangling annotation references dereferences freed memory.

Exploitation requires user interaction, since the victim must open the crafted PDF. The attack vector is local, and successful exploitation yields high impact to confidentiality, integrity, and availability. The current EPSS probability is 0.116%, indicating low observed exploitation activity to date.

Root Cause

The root cause is improper lifetime management of pop-up annotation objects tied to PDF pages. When embedded JavaScript invokes page deletion, the underlying page object is destroyed while pop-up annotation pointers remain live. Later write operations reach into memory that has been reallocated, producing a classic use-after-free condition tracked under [CWE-416].

Attack Vector

An attacker crafts a PDF that embeds JavaScript to delete one or more pages during document processing. The victim opens the file in a vulnerable Foxit PDF Editor or Reader build on Windows. After page deletion, the script or the renderer triggers a write to the now-invalid pop-up annotation. The write corrupts memory, resulting in a crash and, with heap grooming, potential arbitrary code execution under the user's privileges.

No public proof-of-concept exploit is currently available. See the Foxit Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-13126

Indicators of Compromise

Unexpected crashes of FoxitPDFEditor.exe or FoxitPDFReader.exe shortly after opening a PDF
Windows Error Reporting (WER) entries referencing access violations in Foxit modules during JavaScript execution
PDF files containing /JS or /JavaScript action dictionaries that invoke deletePages() followed by annotation manipulation

Detection Strategies

Inspect inbound PDFs at email and web gateways for embedded JavaScript that calls this.deletePages() combined with pop-up annotation writes
Correlate process crash telemetry from Foxit binaries with recent PDF file open events on the same host
Alert on Foxit processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe

Monitoring Recommendations

Monitor endpoint EDR telemetry for memory access violations originating in Foxit rendering and annotation modules
Track PDF files delivered via email attachments and downloads that contain JavaScript actions targeting page objects
Log and review user reports of Foxit application crashes to identify potential exploitation attempts

How to Mitigate CVE-2026-13126

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the Foxit Security Bulletin
Disable JavaScript execution in Foxit PDF Editor and Reader preferences until patches are deployed
Restrict opening of PDFs from untrusted email senders and web sources

Patch Information

Foxit has published fixed builds through its security bulletin portal. Administrators should identify affected installations across the Windows estate and deploy the vendor-supplied updates via software distribution tooling. Reference the Foxit Security Bulletin for exact fixed version numbers and download links.

Workarounds

In Foxit preferences, navigate to JavaScript settings and uncheck Enable JavaScript Actions to block the embedded script trigger
Configure application allow-listing to prevent unpatched Foxit binaries from executing until updates are applied
Route PDFs through a sandboxed viewer or server-side rendering service for untrusted sources

bash

# Configuration example: disable JavaScript in Foxit via registry on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f