ZDI-CAN-30270: ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

Published Aug 24, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-13128.

Affected Software

1 affected component

Foxit PDF Reader

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Foxit PDF Reader to a version that resolves this vulnerability.
Patch ZDI-26-602

Event History

Aug 24, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What must an attacker do to exploit this vulnerability?

An attacker must induce the target to visit a malicious page or open a malicious file. Successful exploitation can result in arbitrary code execution on the affected Foxit PDF Reader installation.

How severe is this issue?

ZDI assigned this vulnerability a CVSS score of 7.8, and the reported risk score is 81.

ZDI-CAN-30270: ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this vulnerability?

How severe is this issue?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this vulnerability?

How severe is this issue?