Description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:13.070Z",
  "pubdate": "2026-09-23T08:17:13.070Z",
  "executiveSummary": "A use-after-free (UAF) vulnerability has been identified in Foxit PDF Editor and Foxit PDF Reader related to the processing of malformed PDF form fields. The vulnerability stems from improper validation protocols during the traversal of form field names, leading to a memory corruption condition.\nThe vulnerability allows an attacker to manipulate memory management structures within the application's process space. Successful exploitation can trigger an application crash, resulting in a denial-of-service (DoS) condition. Furthermore, UAF vulnerabilities of this nature potentially permit an attacker to execute arbitrary code within the context of the application by dangling pointer dereferencing, contingent on successful heap grooming.\nThis vulnerability affects users of Foxit PDF Editor and Foxit PDF Reader. Exploitation typically requires the user to interact with a specially crafted, malicious PDF file. The risk is considered high due to the potential for remote code execution (RCE) via weaponized document attachments. There is no evidence of authentication being required to trigger this vulnerability, as the processing of the malicious object occurs during standard document rendering.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure memory management implementation within the PDF form field parsing engine of Foxit PDF Editor and Reader. During the traversal of the PDF document object model (DOM), specifically when processing the hierarchical structure of form fields, the application fails to correctly maintain reference counts or validate the lifecycle of specific objects associated with field identifiers.\nThe vulnerability manifests when the application engine encounters a malformed form field structure that triggers an unexpected state transition or object deletion. If the application logic attempts to reference a previously released memory object (the 'dangling pointer') during the traversal sequence, a use-after-free condition occurs.\nExploitation flow involves the following steps: First, an attacker constructs a malicious PDF file containing crafted form field entries designed to induce a specific sequence of object allocations and deallocations. By manipulating the object graph, the attacker forces the application to free a specific memory chunk that is subsequently re-allocated for an object controlled or influenced by the attacker's input.\nWhen the PDF engine resumes traversal, it attempts to access the original memory location, now containing malicious data or a re-purposed object. If the dangling pointer is dereferenced to execute a function pointer or access an object method, control flow hijacking may be achieved. If the pointer access is performed without appropriate heap synchronization, it results in a segmentation fault and application termination (crash).\nThis vulnerability exists within the document rendering and form processing component of the software. Because it is triggered by parsing document metadata and structural fields, it does not require prior authentication. The exploitation requires the victim to open the malicious document. Post-exploitation, the attacker gains the ability to execute arbitrary code with the same privileges as the user running the Foxit application, facilitating further system compromise, lateral movement, or data exfiltration. The complexity of successful exploitation is heightened by modern memory mitigation techniques such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), though these are not absolute barriers to UAF exploitation."
}