CVE-2026-91816: Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Published Sep 23, 2026
·Updated
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.
Affected Software
9 affected components
Foxit PDF Editor/Reader
All of the following
Any of the following
Foxit PDF Editor<=13.2.5.63482
Foxit PDF Editor>=14.0.0.33046<=14.0.7.33751
Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028
Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687
Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737
Foxit PDF Editor>=2026.1.0.36452<=2026.2.0.39747
Foxit PDF Reader<=2026.2.0.39747
Microsoft Windows
Event History
Sep 23, 2026
CVE Published
via MITRE·07:49 AM
Data Sourced
via MITRE·07:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
Exploitation requires user interaction and a PDF containing embedded JavaScript that triggers reentrant annotation deletion. The attack vector is local, and no privileges are required.
2
What is the potential impact if exploitation succeeds?
The vulnerability can cause an application crash and is rated as having high confidentiality, integrity, and availability impact. It may result in remote code execution in the affected application context.