CVE-2026-91816: Foxit PDF Use-After-Free Vulnerability

CVE-2026-91816 Overview

CVE-2026-91816 is a use-after-free vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the application's handling of PDF annotations. Embedded JavaScript can trigger reentrant annotation deletion, causing the application to access an annotation object after it has been freed.

Successful exploitation results in a use-after-free condition and application crash. Under memory conditions favorable to an attacker, use-after-free bugs of this class can lead to arbitrary code execution in the context of the current user. Exploitation requires a user to open a crafted PDF document.

Critical Impact
A crafted PDF containing malicious JavaScript can corrupt Foxit's annotation object lifecycle, producing a use-after-free that crashes the application and may enable local code execution in the user's security context.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Specific affected versions are enumerated in the Foxit Security Bulletins

Discovery Timeline

2026-09-23 - CVE-2026-91816 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91816

Vulnerability Analysis

The vulnerability is classified as a use-after-free flaw [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. Foxit's JavaScript engine permits document scripts to invoke operations that delete annotation objects. When deletion is triggered reentrantly during another annotation operation, an outer stack frame retains a dangling pointer to the released object.

Subsequent access to that pointer reads or writes freed heap memory. The immediate consequence is memory corruption and an application crash. An attacker who controls heap layout can potentially replace the freed annotation with attacker-shaped data, converting the condition into arbitrary code execution.

Exploitation requires user interaction: the victim must open a malicious PDF document in a vulnerable Foxit build. The attack executes in the local context of the user running the reader.

Root Cause

The root cause is missing lifetime management between Foxit's annotation subsystem and its embedded JavaScript engine. When JavaScript deletes an annotation mid-operation, the containing code path does not re-validate its pointer to the annotation object. The freed object is dereferenced on return, satisfying the classic use-after-free pattern.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted PDF containing JavaScript that programmatically deletes an annotation while a parent annotation operation is still in flight. Common delivery mechanisms include phishing email attachments, drive-by downloads, and files staged on shared network locations.

No verified proof-of-concept exploit code has been published for CVE-2026-91816. Technical details are limited to the vendor advisory. See the Foxit Security Bulletins for further information.

Detection Methods for CVE-2026-91816

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe, particularly following the opening of PDF attachments
Windows Error Reporting (WER) or crash-dump artifacts referencing Foxit annotation or JavaScript modules
PDF files containing JavaScript that invokes annotation deletion APIs such as this.removeField() or this.getAnnot().destroy() during annotation event handlers
Inbound PDFs from untrusted senders that embed JavaScript actions tied to annotation events

Detection Strategies

Inspect email gateway and web proxy logs for PDF attachments containing /JavaScript and /JS objects paired with annotation manipulation calls
Correlate Foxit process crashes with recent file-open events to identify candidate malicious documents
Deploy YARA rules that flag PDFs combining annotation objects (/Annot, /AA) with JavaScript that mutates the annotation tree

Monitoring Recommendations

Enable endpoint telemetry for process termination, module load, and child-process creation events originating from Foxit binaries
Alert on Foxit processes spawning cmd.exe, powershell.exe, or other LOLBins, which would be atypical for benign PDF rendering
Retain crash dumps from Foxit processes for at least 30 days to support forensic analysis of suspected exploitation attempts

How to Mitigate CVE-2026-91816

Immediate Actions Required

Inventory all endpoints running Foxit PDF Editor or Foxit PDF Reader and identify versions predating the vendor-supplied fix
Apply the patched build referenced in the Foxit Security Bulletins as soon as validation permits
Restrict opening of PDF files received from untrusted external senders until patching completes
Educate users on the phishing delivery risk associated with unsolicited PDF attachments

Patch Information

Foxit has published fixed builds through its security bulletin portal. Refer to the Foxit Security Bulletins for the specific patched version numbers, download links, and any prerequisite update paths. Enterprise deployments should stage the update through standard change-management channels before broad rollout.

Workarounds

Disable JavaScript execution in Foxit by navigating to File > Preferences > JavaScript and clearing the Enable JavaScript Actions option
Enable Safe Reading Mode to restrict unsafe operations invoked from PDF documents
Configure email and web gateways to strip or sandbox PDFs containing embedded JavaScript
Deploy application allow-listing and Attack Surface Reduction rules that block Foxit from launching child processes

bash

# Disable JavaScript in Foxit PDF Reader/Editor via Windows registry
# Adjust the version key to match the installed Foxit build
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enable Safe Reading Mode
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\TrustManager" /v bSafeReadingMode /t REG_DWORD /d 1 /f