Description

When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:10.873Z",
  "pubdate": "2026-09-23T08:17:10.873Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) flaw residing within the image rendering engine of Foxit PDF Editor and Foxit PDF Reader.\nThe vulnerability occurs due to improper validation of optional content attributes associated with image objects, which leads to memory corruption during the rendering process.\nAn attacker can exploit this flaw by providing a maliciously crafted PDF document, which, when rendered by the target application, triggers a UAF condition.\nSuccessful exploitation results in an application crash, causing a Denial of Service (DoS). Given the nature of memory corruption vulnerabilities, there is a potential for arbitrary code execution if the attacker can influence the heap layout and hijack control flow.\nThe vulnerability is client-side, requiring the user to open a malicious PDF file.\nNo authentication or elevated privileges are required for an attacker to craft the malicious payload, making it a significant risk for users who interact with untrusted documents.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper state management of internal memory objects during the rendering lifecycle within Foxit PDF Editor and Reader. Specifically, when the application encounters image objects containing malformed optional content attributes (OCGs or visibility configurations), it fails to perform adequate input validation before processing these structures.\nThe attack flow begins when an attacker embeds a specially crafted PDF document containing malformed image object metadata. When the victim opens the document, the application's rendering engine attempts to parse and render the embedded image. During this process, the engine allocates internal structures to track the visibility and properties of the image object.\nDue to the lack of validation on the optional content attributes, the application enters an error state or an unexpected control flow path. This path triggers an premature deallocation (free) of the internal data structure responsible for managing the image object's lifecycle. However, the rendering engine retains a pointer to this freed memory location.\nSubsequent operations within the rendering pipeline then attempt to access or operate on this 'dangling pointer.' Because the memory block has already been returned to the heap allocator, it may have been reclaimed for other purposes by the time the dangling pointer is dereferenced.\nExploitation involves heap grooming to ensure that a predictable object is allocated into the memory previously occupied by the freed structure. By overwriting the contents of the freed memory, an attacker can coerce the application into executing arbitrary code when the engine later invokes methods or accesses members via the stale pointer.\nThe vulnerability manifests as a memory corruption issue that typically results in an immediate crash of the rendering process. If successfully exploited beyond simple process termination, the attacker gains the execution context of the user running the application, potentially bypassing standard security controls to achieve persistence or data exfiltration. The complexity of the vulnerability is tied to the internal heap state, making the successful outcome dependent on the specific memory allocation patterns of the environment in which the PDF is rendered."
}