Description

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:10.987Z",
  "pubdate": "2026-09-23T08:17:10.987Z",
  "executiveSummary": "This vulnerability involves a use-after-free condition within Foxit PDF Editor and Reader triggered by reentrant JavaScript execution during page-visibility events.\nThe flaw allows a remote attacker to achieve an invalid memory read, leading to an application crash (Denial of Service).\nThe vulnerability resides in the internal handling of page-view objects when calculating annotation boundaries.\nSuccessful exploitation requires an attacker to provide a specially crafted PDF file containing malicious JavaScript, which the victim must open.\nThe risk implication is primarily application instability; however, such use-after-free conditions in complex PDF rendering engines can potentially be weaponized for arbitrary code execution if memory corruption is effectively managed.\nNo authentication is required for exploitation, but the attack depends on user interaction to trigger the rendering of the malicious PDF document.",
  "technicalDetails": "The root cause of this vulnerability is a reentrancy issue within the Foxit PDF engine's JavaScript event handling mechanism. Specifically, the application fails to properly manage the lifecycle of page-view objects when page-visibility events occur.\nWhen a specially crafted PDF is opened, the attacker-supplied JavaScript can trigger page-visibility events during the processing of annotation boundaries. Because the application logic does not anticipate reentrancy during this calculation process, a race condition is introduced.\nThe attack flow begins when the victim opens the malicious document. The PDF contains an annotation object associated with a JavaScript payload. Upon the transition of the page's visibility state, the engine triggers the associated script. This script invokes further rendering or layout calculations that reference the page-view object.\nThe vulnerability manifests when the rendering engine attempts to access an object that has already been deallocated (freed) due to the state change triggered by the reentrant event. The engine continues to operate on this stale pointer while attempting to calculate the bounding box for the annotation.\nThis invalid memory access results in an out-of-bounds read or a dereference of an invalid pointer, leading to a segmentation fault or memory access violation, which terminates the application process.\nWhile this vulnerability is currently identified as causing an application crash, the underlying use-after-free primitive is a significant security concern. In more complex exploitation scenarios, an attacker may use heap grooming techniques to replace the freed object with controlled data, potentially transitioning from a simple crash to remote code execution (RCE) by hijacking the program's control flow through corrupted function pointers or virtual method tables within the PDF rendering process.\nThe vulnerable component is the annotation processing module within the Foxit PDF engine responsible for handling document layout and visibility-based event callbacks."
}