Description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:14.123Z",
  "pubdate": "2026-09-23T08:17:14.123Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Editor and Reader, specifically within the handling of PDF annotation objects.\nThe vulnerability occurs due to improper synchronization during reentrant page-event processing, leading to the premature deallocation of page objects while they remain in use by the application.\nSuccessful exploitation allows a remote attacker to trigger an application crash, potentially leading to arbitrary code execution if the memory state can be manipulated.\nThe vulnerability affects the core JavaScript processing component, which is responsible for executing embedded scripts within PDF files.\nExploitation requires the victim to open a specially crafted malicious PDF document containing embedded JavaScript designed to trigger the reentrant event during the annotation enumeration process.\nThe risk is high for users who regularly interact with untrusted PDF content, as the exploitation is triggered automatically upon rendering the document, bypassing standard user interaction requirements for certain script executions.",
  "technicalDetails": "The root cause of this vulnerability lies in the memory management logic of Foxit's JavaScript handler during the enumeration of PDF annotation objects. When the application iterates through these objects, it invokes an event-handling mechanism that can be leveraged to introduce reentrancy into the processing loop.\nDuring this reentrant execution, the underlying page object associated with the annotations is deallocated (freed) due to the modification or destruction of the page structure during the event trigger. However, the iteration logic maintains a dangling pointer to the original page object. When the enumeration resumes, the engine attempts to access this freed memory, resulting in a use-after-free condition.\nAttack flow: First, an attacker embeds a malicious JavaScript payload within a PDF file's annotation structure. Upon the document being parsed and rendered, the JavaScript engine begins enumerating these annotations. The attacker uses a callback or an event-based trigger to perform operations that modify the document structure or force the disposal of the current page context. Because the JavaScript engine does not properly increment reference counts or validate the persistence of the page object during this reentrant phase, the page object is freed. Subsequent attempts by the engine to access the page object during the remainder of the enumeration loop result in an illegal memory access.\nThe vulnerable component is the JavaScript integration layer within the PDF parsing engine. This component handles complex object models, including annotations, forms, and document structure events. The flaw demonstrates a lack of state protection during synchronous JavaScript execution where document modifications are permitted.\nExploitation may lead to memory corruption, allowing an attacker to overwrite sensitive pointers or function pointers within the process space. If the attacker can control the heap layout—often achieved through heap spraying or grooming techniques—they can replace the freed object with controlled data, potentially hijacking the control flow of the application when the dangling pointer is dereferenced.\nWhile the primary impact is an application crash, the nature of use-after-free vulnerabilities in highly complex engines like PDF parsers frequently leads to remote code execution (RCE) scenarios under the security context of the logged-in user."
}