Description

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:11.110Z",
  "pubdate": "2026-09-23T08:17:11.110Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in Foxit PDF Editor and Reader, stemming from improper handling of reentrant operations triggered by JavaScript actions.\nThe flaw occurs during the processing of specially crafted PDF files that initiate page and annotation-related JavaScript, leading to memory corruption.\nSuccessful exploitation allows an attacker to access memory locations that have already been deallocated, which can result in an application crash or potentially arbitrary code execution.\nThis vulnerability affects users of Foxit PDF Editor and Reader who interact with untrusted PDF content. The exploitation requires the attacker to entice a user to open a malicious PDF file.\nThe risk is significant as it could lead to system instability or be leveraged by threat actors to achieve remote code execution in the context of the current user session.\nNo authentication is required for an attacker to trigger the vulnerability, as it is inherently tied to the parsing and rendering process of the document.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of object lifecycles within the Foxit PDF engine during reentrant JavaScript execution. When a PDF file contains specific JavaScript code designed to trigger zoom or layout-related actions, the application's rendering engine may initiate a sequence of events that causes the underlying page or annotation objects to be freed prematurely while the JavaScript engine still maintains references to them.\nThe exploitation flow begins when an attacker embeds malicious JavaScript within a PDF document. Upon the user opening the document, the integrated JavaScript engine parses the payload, which triggers a complex series of callbacks involving document layout recalculations or zoom level modifications. These callbacks re-enter the PDF object model, specifically targeting annotation objects or page structures.\nDuring these reentrant calls, the application may inadvertently release memory associated with the target page objects while the execution context remains valid. Subsequently, the application attempts to access these now-dangling pointers when finalizing the rendering process or executing further JavaScript operations. This violation of memory safety principles results in a use-after-free condition.\nThe memory management defect is located within the components responsible for the dynamic interaction between the PDF rendering engine and the JavaScript environment. Because the application fails to synchronize the object lifecycle state across these concurrent reentrant operations, an attacker can manipulate the heap state to influence the behavior of the application after the free operation occurs.\nExploitation does not require prior authentication or elevated privileges, provided the application is active and configured to execute JavaScript. If successfully exploited, the primary impact is an application crash due to memory corruption. However, in more advanced scenarios, an attacker may leverage this memory access to overwrite critical function pointers or exploit object vtables to achieve controlled arbitrary code execution. The vulnerability is triggered automatically as soon as the malicious PDF content is rendered, necessitating strict user awareness regarding untrusted file execution."
}