CVE-2026-91799: Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability
Published Sep 23, 2026
·Updated
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.
Affected Software
1 affected component
Foxit PDF Editor/Reader
Event History
Sep 23, 2026
CVE Published
via MITRE·07:50 AM
Data Sourced
via MITRE·07:50 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an attacker to already have access or privileges on the target system?
The CVSS vector indicates local access and no privileges are required. Exploitation also requires user interaction, consistent with a user opening a specially crafted PDF.
2
What level of impact could successful exploitation have?
Successful exploitation may crash the application or result in arbitrary code execution. The CVSS metrics indicate potential high impact to confidentiality, integrity, and availability.