CVE-2026-91818: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2026-91818 Overview

CVE-2026-91818 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the JavaScript engine's handling of PDF annotations. During annotation enumeration, reentrant page-event processing can release the associated page object. Subsequent code paths then access the freed memory, causing an application crash and potentially enabling arbitrary code execution in the context of the user.

Exploitation requires a user to open a crafted PDF document. The attack vector is local and depends on user interaction, but successful exploitation impacts confidentiality, integrity, and availability.

Critical Impact
An attacker who convinces a user to open a malicious PDF can trigger memory corruption in the Foxit process, leading to a crash or possible code execution with the current user's privileges.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Specific version ranges are enumerated in the Foxit Security Bulletins

Discovery Timeline

2026-09-23 - CVE-2026-91818 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91818

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered through the interaction between Foxit's JavaScript engine and its annotation processing subsystem. When PDF JavaScript enumerates annotations on a page, page-event callbacks can execute reentrantly. These callbacks can invalidate or release the page object that the enumeration loop still references. When execution returns to the enumeration path, it dereferences a stale pointer to the freed page object.

The resulting memory access on freed memory typically produces an application crash. In favorable conditions for the attacker, controlled reallocation of the freed region allows arbitrary read, write, or control-flow hijacking within the Foxit process.

Root Cause

The root cause is unsafe object lifetime management during reentrant script execution. The annotation enumeration logic does not hold a strong reference to the page object across JavaScript callback boundaries. Page-event handlers invoked during enumeration can free the page, leaving the enumerator with a dangling pointer. The flaw is classified as CWE-416 (Use After Free).

Attack Vector

An attacker crafts a PDF that embeds JavaScript to enumerate annotations while triggering a page event that releases the page. The victim opens the PDF in a vulnerable version of Foxit PDF Editor or Reader. No network access or elevated privileges are required, but user interaction is mandatory. Delivery vectors include email attachments, web downloads, and shared document repositories.

No verified public proof-of-concept code is available. Refer to the Foxit Security Bulletins for vendor-provided technical details.

Detection Methods for CVE-2026-91818

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe following the opening of a PDF document
Windows Error Reporting (WER) or crash dumps referencing access violations in the JavaScript or annotation modules of Foxit
PDF files containing JavaScript that enumerates annotations while invoking page-open, page-close, or page-change events

Detection Strategies

Inspect inbound PDFs for embedded JavaScript that iterates this.getAnnots() or annotation collections while registering page-event handlers
Alert on Foxit process crashes correlated with recent PDF file opens using endpoint telemetry
Apply YARA signatures for PDFs combining /JS, /JavaScript, and annotation dictionaries with /AA (additional-action) entries on /Page objects

Monitoring Recommendations

Forward Foxit application crash events and WER telemetry to a centralized log platform for correlation with process ancestry and file opens
Monitor endpoints for child processes spawned by Foxit binaries, which may indicate post-exploitation activity
Track PDF file provenance and flag documents originating from untrusted email senders or external download sources

How to Mitigate CVE-2026-91818

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the Foxit Security Bulletins
Inventory all endpoints running Foxit software and prioritize patching for users who routinely process external PDFs
Restrict opening of untrusted PDFs until patched versions are deployed

Patch Information

Foxit has issued security updates addressing this use-after-free vulnerability. Consult the Foxit Security Bulletins for the exact patched version numbers corresponding to Foxit PDF Editor and Foxit PDF Reader.

Workarounds

Disable JavaScript execution in Foxit via Preferences → JavaScript → uncheck Enable JavaScript Actions
Enable Safe Reading Mode to restrict potentially unsafe operations when opening PDFs
Block or quarantine PDFs containing embedded JavaScript at the email gateway or secure web gateway
Use application allowlisting to prevent child processes from being spawned by Foxit binaries

bash

# Registry configuration to disable JavaScript in Foxit PDF Reader (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f

# Enable Safe Reading Mode
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\Trust Manager" /v bSafeMode /t REG_DWORD /d 1 /f