Description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:13.900Z",
  "pubdate": "2026-09-23T08:17:13.900Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw residing in the Foxit PDF Editor/Reader annotation management subsystem. The issue stems from improper handling of object lifecycles during reentrant JavaScript execution.\nThe vulnerability allows a remote attacker to achieve arbitrary code execution or cause an application crash by crafting a malicious PDF document containing embedded JavaScript that triggers the deletion of an annotation object while the application is still actively referencing it.\nSuccessful exploitation compromises the integrity, confidentiality, and availability of the host system. By forcing the application to reference dangling pointers, an attacker can manipulate heap memory, potentially diverting the execution flow to malicious shellcode.\nThe risk is considered critical, as the attack vector requires only that a user open a maliciously crafted PDF file. No authentication or elevated privileges are required, and the vulnerability is exploitable via standard user-interaction-based attack chains.",
  "technicalDetails": "The root cause of this use-after-free vulnerability is a race condition or logic flaw within the annotation handling engine when processing embedded JavaScript commands. Specifically, when the PDF engine executes JavaScript, it may initiate methods that modify the Document Object Model (DOM) of the PDF, such as the deletion of an annotation object.\nIf the annotation deletion occurs within a reentrant context—where the application is currently traversing or utilizing an existing pointer to that specific annotation object—the object is deallocated while the application remains unaware of the state change. The pointer subsequently becomes a dangling pointer.\nThe exploitation flow typically involves three stages. First, the attacker embeds a malicious script that invokes an annotation removal method (e.g., via the Annots API). Second, the script forces the application to re-access the object through a separate, simultaneous instruction or a deeply nested callback that operates on the freed memory location. Third, the attacker leverages heap grooming or spraying techniques to occupy the vacated memory slot with controlled data, often containing a ROP chain or shellcode.\nBecause Foxit PDF Editor/Reader facilitates the execution of JavaScript to provide interactive PDF features, the attack surface is exposed whenever an attacker can induce a user to load an untrusted document. The lack of proper validation or state tracking during reentrant API calls allows the application to proceed with operations on a stale memory address, leading to memory corruption.\nThe impact of the use-after-free is severe; once the memory is reallocated with attacker-supplied content, subsequent operations performed by the application using that object will result in the execution of injected instructions rather than legitimate annotation processing. This facilitates arbitrary code execution with the permissions of the local user process.\nThis vulnerability persists in environments where JavaScript execution is enabled, which is the default configuration for many enterprise deployments of Foxit PDF software. The flaw bypasses standard software memory protections if the attacker can successfully predict the heap layout during the reentrant trigger."
}