CVE-2026-13129 Overview
CVE-2026-13129 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. When the application opens a crafted PDF file, embedded JavaScript uses a damaged field tree to trigger field traversal. The traversal causes the program to hold an invalid form object when accessing the field property path. The application then dereferences an invalid pointer and crashes, and the condition can be leveraged for code execution in the context of the current user.
Critical Impact
A crafted PDF opened in Foxit PDF Editor or Reader can trigger memory corruption leading to arbitrary code execution or denial of service on the local user's session.
Affected Products
- Foxit PDF Editor on Microsoft Windows
- Foxit PDF Reader on Microsoft Windows
- Microsoft Windows host environments running vulnerable Foxit versions
Discovery Timeline
- 2026-07-08 - CVE-2026-13129 published to the National Vulnerability Database (NVD)
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-13129
Vulnerability Analysis
CVE-2026-13129 is classified as a use-after-free condition [CWE-416] in the PDF form-handling logic. The affected code path parses and traverses the interactive form field tree when a document is opened. If a PDF contains a malformed or intentionally damaged field tree, JavaScript embedded in the document can invoke field traversal routines that operate on stale form objects. The application continues to access the field property path through a dangling reference, dereferencing memory that has already been freed.
The result is either an immediate crash from reading an invalid pointer or, when the freed memory is reallocated with attacker-controlled data, an exploitable memory corruption primitive. Successful exploitation runs code with the privileges of the user opening the file.
Root Cause
The root cause is missing lifetime validation between the JavaScript engine and the form field tree. When the field tree structure is damaged, cleanup routines free underlying form objects while the traversal logic still retains pointers to them. The property path accessor does not verify that the referenced form object is still valid before dereferencing it.
Attack Vector
Exploitation requires a local attack vector with user interaction. An attacker delivers a crafted PDF through email, a web download, or a shared file location. When the victim opens the document in Foxit PDF Editor or Foxit PDF Reader, embedded JavaScript triggers the damaged field tree traversal and the use-after-free condition executes without further interaction.
No verified public proof-of-concept code is available. See the Foxit Security Bulletins for vendor technical details.
Detection Methods for CVE-2026-13129
Indicators of Compromise
- Unexpected crashes of FoxitPDFEditor.exe or FoxitPDFReader.exe shortly after opening a PDF, with Windows Error Reporting entries citing access violations.
- PDF documents containing embedded JavaScript that enumerates or manipulates AcroForm field trees from untrusted sources.
- Child processes spawned by Foxit binaries such as cmd.exe, powershell.exe, or rundll32.exe following document open events.
Detection Strategies
- Inspect PDF attachments statically for /AcroForm, /JS, and /JavaScript objects combined with malformed /Kids or /Parent field references.
- Correlate Windows crash telemetry (Event ID 1000, 1001) referencing Foxit binaries with recent document-open activity.
- Alert on Foxit processes performing network connections or writing executable content to disk immediately after PDF rendering.
Monitoring Recommendations
- Forward Sysmon process, image load, and file create events from endpoints running Foxit software to a central analytics platform.
- Monitor mail gateway and web proxy logs for inbound PDF files from unverified senders, especially those containing embedded scripts.
- Track Foxit application version inventory across managed endpoints to identify hosts still exposed to CVE-2026-13129.
How to Mitigate CVE-2026-13129
Immediate Actions Required
- Apply the fixed Foxit PDF Editor and Foxit PDF Reader builds referenced in the Foxit Security Bulletins to all Windows endpoints.
- Restrict opening of PDF files originating from untrusted email or web sources until patching is complete.
- Identify and prioritize high-risk users such as executives, finance, and HR who receive external PDFs routinely.
Patch Information
Foxit has published corrective updates through its security bulletin process. Consult the Foxit Security Bulletins for the specific fixed version corresponding to CVE-2026-13129 and deploy it through your standard software distribution mechanism.
Workarounds
- Disable JavaScript execution in Foxit PDF Editor and Reader via Preferences > JavaScript > Enable JavaScript Actions until patches are applied.
- Enable Foxit Safe Reading Mode to restrict active content, external URL access, and scripting inside PDF documents.
- Enforce Attack Surface Reduction rules on Windows that block child process creation from Office and PDF readers.
# Example: disable Foxit JavaScript via registry on managed Windows endpoints
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
