Description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:11.907Z",
  "pubdate": "2026-09-23T08:17:11.907Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability has been identified within the JavaScript engine of Foxit PDF Editor and Reader. The vulnerability stems from improper memory management during the processing of JavaScript array objects. A remote attacker could exploit this flaw by enticing a victim to open a specially crafted PDF document containing malicious JavaScript code.\nSuccessful exploitation allows for memory corruption, which may lead to an application crash or the execution of arbitrary code within the context of the current user. Given the ubiquity of PDF document exchange, this vulnerability presents a significant risk to organizational security, as it provides a pathway for code execution without requiring prior authentication or administrative privileges. The complexity of the heap layout manipulation required for successful exploitation typically necessitates a high level of technical sophistication from an attacker.",
  "technicalDetails": "The core of the vulnerability resides in the improper handling of object lifecycles within the Foxit PDF JavaScript engine when performing operations on array objects. Specifically, the engine fails to maintain correct reference counting or object tracking when an array is manipulated or reallocated during certain script execution flows. This inconsistency results in a use-after-free condition where the application retains a dangling pointer to a memory region that has already been deallocated or returned to the heap allocator.\nThe exploitation flow typically begins with an attacker constructing a malicious PDF file that executes JavaScript designed to trigger the vulnerable code path. The attacker first allocates an array object and then performs operations—such as resizing, shifting, or reassigning elements—that induce the underlying JavaScript engine to release the memory occupied by the object while retaining a reference to it in another part of the engine's internal state. By subsequently triggering an allocation of a different object of a similar size, the attacker can influence the heap manager to reclaim the memory previously occupied by the original array object. This is a classic heap grooming technique aimed at achieving type confusion or controlling the contents of the dangling pointer.\nOnce the memory slot is reoccupied by attacker-controlled data, the application attempts to use the dangling pointer to access the original JavaScript object. This access now refers to the attacker's injected data, effectively bypassing type safety checks. By overwriting function pointers, objects metadata, or virtual method tables within the corrupted memory space, the attacker can redirect the program's execution flow. In a successful exploitation scenario, this allows for the redirection of control flow to arbitrary code (e.g., Return-Oriented Programming chains) embedded in the malicious PDF. This vulnerability does not require the attacker to have pre-existing access to the system, nor does it require administrative privileges; the execution occurs with the same permissions as the user running the application. The final impact is the potential for full system compromise, data theft, or malware installation on the target machine upon successful execution of the payload."
}