CVE-2026-5942 PUBLISHED

Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability

Assigner: Foxit
Reserved: 09.04.2026 Published: 27.04.2026 Updated: 27.04.2026

Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor Foxit Software Inc.
Product Foxit PDF Editor
Versions Default: unaffected
  • Version Versions 2026.1 and earlier is affected
  • Version Versions 14.0.3 and earlier is affected
  • Version Versions 13.2.3 and earlier is affected
Vendor Foxit Software Inc.
Product Foxit PDF Reader
Versions Default: unaffected
  • Version Versions 2026.1 and earlier is affected

Credits

  • Anonymous working with TrendAI Zero Day Initiative finder

References

Problem Types

  • CWE-416 Use after free CWE

Impacts

  • Potential arbitrary code execution