ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

Published Aug 24, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-13128.

Affected Software

1 affected component

Foxit PDF Reader

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Foxit PDF Reader to a version that resolves this vulnerability.
Patch ZDI-26-602

Event History

Aug 24, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

The attacker must persuade the target to visit a malicious page or open a malicious file. Exploitation requires user interaction.

What is the potential impact of successful exploitation?

A remote attacker can execute arbitrary code on an affected Foxit PDF Reader installation. The issue is assigned CVE-2026-13128 and has a CVSS rating of 7.8.