CVE-2026-13128: Foxit PDF Editor DOS Vulnerability

CVE-2026-13128 Overview

CVE-2026-13128 affects Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. Embedding JavaScript within a PDF file causes a page to be deleted while subsequent scripts continue to access properties of the document view. This condition results in a use-after-free ([CWE-416]) that crashes the application and can be leveraged for code execution in the process context.

Exploitation requires a user to open a crafted PDF document. The flaw is tracked with a CVSS 3.1 base score of 7.8 and impacts confidentiality, integrity, and availability of the affected host.

Critical Impact
A crafted PDF opened in Foxit PDF Editor or Reader triggers a use-after-free that crashes the process and may allow arbitrary code execution with the user's privileges.

Affected Products

Foxit PDF Editor on Microsoft Windows
Foxit PDF Reader on Microsoft Windows
Microsoft Windows host platform

Discovery Timeline

2026-07-08 - CVE-2026-13128 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-13128

Vulnerability Analysis

CVE-2026-13128 is a use-after-free ([CWE-416]) vulnerability in the JavaScript engine used by Foxit PDF Editor and Foxit PDF Reader. When a PDF embeds JavaScript that deletes a page, the underlying page object and the document view state referencing it are freed. Subsequent scripts inside the same document still hold references to document view properties tied to that freed memory.

Accessing those dangling references produces an invalid memory read or write. The result is an application crash and, depending on heap layout at the moment of the reuse, an opportunity for arbitrary code execution inside the Foxit process.

The attack vector is local and requires user interaction. An attacker must convince the target to open a crafted PDF, typically delivered through email, chat, or a drive-by download. No elevated privileges are required on the target system.

Root Cause

The root cause is missing lifetime management between the JavaScript API surface and document view objects. Deleting a page through a script does not invalidate handles that later scripts use to read view properties, so the reader dereferences memory that has already been released and reallocated.

Attack Vector

An attacker crafts a PDF containing scripted logic that first removes a page and then queries properties of the document view. The victim opens the file in Foxit PDF Editor or Reader on Windows, at which point the embedded scripts execute and reach the freed object. See the Foxit Security Bulletin for advisory content and fixed versions.

No public proof-of-concept exploit or in-the-wild activity is recorded for this CVE. The EPSS probability at publication is 0.116%.

Detection Methods for CVE-2026-13128

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF attachment.
Windows Error Reporting (WER) entries referencing access violations inside Foxit modules tied to JavaScript execution.
PDF files delivered by email or download that contain /JS, /JavaScript, or deletePages API calls in their object streams.

Detection Strategies

Inspect inbound PDFs at the mail gateway for embedded JavaScript that invokes page deletion followed by document view access.
Correlate application crash events (Event ID 1000) for Foxit binaries with recent process launches spawned from mail or browser download folders.
Hunt for suspicious child processes spawned by Foxit executables, which would indicate successful exploitation beyond a crash.

Monitoring Recommendations

Forward Windows Application and WER logs to a centralized log platform and alert on repeated Foxit crashes across endpoints.
Monitor endpoint telemetry for Foxit processes performing memory allocation anomalies or loading unsigned modules after opening a PDF.
Track file provenance so PDFs from external senders that trigger crashes can be quarantined and analyzed.

How to Mitigate CVE-2026-13128

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the fixed builds identified in the vendor advisory.
Restrict opening of PDFs from untrusted sources until endpoints are patched.
Enforce standard user privileges so that a successful exploit does not gain administrative access on the host.

Patch Information

Foxit has published fixed versions through its security bulletin channel. Review the Foxit Security Bulletin for the exact patched build numbers for Foxit PDF Editor and Foxit PDF Reader on Windows, and deploy through your standard software update process.

Workarounds

Disable JavaScript execution in Foxit PDF Editor and Reader under Preferences > JavaScript until patches are applied.
Block or strip embedded JavaScript from PDF attachments at the email security gateway.
Open untrusted PDFs inside a sandboxed viewer or isolated browser session rather than the native Foxit client.

bash

# Registry-based workaround: disable JavaScript in Foxit PDF Reader (per-user)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f

# Same setting for Foxit PDF Editor
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f