Description

When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:11.223Z",
  "pubdate": "2026-09-23T08:17:11.223Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in Foxit PDF Editor and Foxit PDF Reader. The flaw stems from improper memory management during the processing of annotation rich-text attributes containing malformed font data.\nSuccessful exploitation allows an attacker to trigger an application crash or potentially execute arbitrary code by manipulating memory states. The vulnerability is triggered when a user opens a specially crafted PDF document.\nThis issue impacts the integrity and availability of the application, as an attacker with the ability to deliver a malicious file can disrupt service or perform memory corruption attacks. No specific authentication or network interaction is required beyond the user-assisted opening of a malicious file, making this a significant threat to end-user systems.\nThe vulnerability highlights a breakdown in object lifecycle management within the annotation rendering engine, which could be leveraged by an attacker to gain control over the application's execution flow.",
  "technicalDetails": "The vulnerability is a use-after-free condition located within the Foxit PDF Editor and Foxit PDF Reader annotation processing engine. The root cause lies in the application's handling of rich-text attributes during the reconstruction of annotation appearances.\nThe attack flow initiates when the application parses a specially crafted PDF containing malformed font data embedded within annotation objects. Upon invocation of internal scripting functions, the engine modifies the rich-text attributes associated with these annotations. During the subsequent process of appearance reconstruction—where the PDF engine generates the visual representation of the annotation—the application erroneously references an object that has already been deallocated from heap memory.\nBecause the memory associated with the font data or attribute object is freed while a dangling pointer remains active, the application attempts to access or dereference this invalid memory address. This state transition leads to an access violation or a segmentation fault, effectively crashing the application. In a sophisticated attack scenario, if the freed memory is reallocated by the heap allocator before the dangling pointer is dereferenced, an attacker could potentially groom the heap to influence the application state, leading to controlled memory corruption or arbitrary code execution.\nThe vulnerable component is the annotation rendering subsystem responsible for interpreting and drawing rich-text formatting. This component fails to implement adequate reference counting or synchronization when handling object state changes triggered by script-based modifications. Because the trigger is document-contained, there is no requirement for remote network interaction; the attack is successful as long as the user opens the malicious PDF file. The vulnerability is present in versions of Foxit PDF Editor and Reader that lack robust validation for font data integrity within rich-text fields. Post-exploitation, the primary impact is denial of service (DoS), but the potential for remote code execution remains a high-severity concern due to the nature of use-after-free flaws in memory-managed environments."
}