CVE-2026-91791: Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the issue?
An attacker must craft a PDF that triggers JavaScript through page-visibility events and cause it to be processed by Foxit PDF Editor or Reader. User interaction is required, consistent with the UI:R vector.
Who is most exposed to this vulnerability?
Users who open untrusted or attacker-supplied PDF files in Foxit PDF Editor or Reader are exposed. The attack vector is local, so the vulnerable application must process the crafted document on the target system.
Does the available information confirm whether default settings are affected?
No. The provided information does not state whether JavaScript or the relevant page-visibility event handling is enabled in default configurations.
How can defenders determine whether a crash may be related to this issue?
Look for Foxit PDF Editor or Reader crashes while opening or viewing a PDF, particularly when annotation boundary calculation occurs after JavaScript is triggered by page-visibility events. The supplied data does not provide log signatures, affected versions, or other definitive indicators.