Description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:12.693Z",
  "pubdate": "2026-09-23T08:17:12.693Z",
  "executiveSummary": "A use-after-free (UAF) vulnerability exists within the Foxit PDF Editor and Reader form field management subsystem. This flaw occurs during the lifecycle handling of PDF form fields when accessed via embedded JavaScript. The vulnerability allows a remote attacker to trigger an application crash, potentially leading to arbitrary code execution if successfully exploited. The issue resides in the memory management logic, specifically where object references persist after the corresponding form field objects have been deallocated. By crafting a malicious PDF document containing specific JavaScript routines, an attacker can manipulate the application's heap state to achieve a use-after-free condition. This poses a significant risk to confidentiality, integrity, and availability, as successful exploitation may allow for system compromise if the attacker can achieve reliable remote code execution. No authentication is required to trigger this vulnerability, as the attack vector is limited to opening a maliciously crafted PDF file.",
  "technicalDetails": "The vulnerability is rooted in the unsafe handling of form field object references within the JavaScript engine of Foxit PDF Editor/Reader. Specifically, the application fails to properly nullify or manage the lifecycle of object pointers after the underlying memory associated with a PDF form field has been freed during a layout or document structural change. This is a classic use-after-free memory corruption issue.\nThe attack flow begins when an attacker embeds a specifically crafted JavaScript payload within a malicious PDF file. When the user opens this file, the PDF engine parses the form fields. The JavaScript environment within the application maintains references to these form objects. The attacker triggers a document-level action or a form manipulation routine that forces the application to release the memory allocated for these objects—for instance, by triggering a structural change or object replacement while the JavaScript engine still maintains active pointers to the discarded object.\nOnce the target object is deallocated (freed) and the memory region is reclaimed by the heap manager for other purposes, the malicious JavaScript executes further operations that attempt to dereference the dangling pointer. Because the application logic does not verify the validity of the object reference before accessing it, it performs an operation on the memory address now potentially occupied by attacker-controlled data. This access facilitates control over the instruction pointer or data structures used for subsequent application logic execution.\nExploitation requires the attacker to successfully manipulate the heap, a process often referred to as heap grooming, to ensure that the memory formerly occupied by the form field is reallocated with data structures containing malicious payloads. By replacing the freed memory with attacker-supplied objects, the subsequent use of the dangling pointer allows for controlled reads or writes in the context of the application's process. The vulnerability does not require prior authentication, as the attack is delivered via a file-based vector, and the execution is performed within the security context of the user running the Foxit application."
}