CVE-2026-13126 – Foxit PDF Editor
“A single malicious PDF can turn a routine document into a security event if critical validation is missing.”
This update addresses multiple high-severity memory handling and input validation vulnerabilities in Foxit PDF Editor that could be triggered by opening specially crafted PDF files. The fixes strengthen object validation, memory management, pointer handling, and annotation processing to prevent application crashes and reduce the risk of exploitation through malicious documents.
CVE-2026-13126 has a CVSS score of 7.8, High severity. It addresses a use-after-free condition caused by JavaScript deleting PDF pages before invalid annotation objects were accessed. CVE-2026-57260 has a CVSS score of 7.8, High severity. It corrects improper pointer handling while parsing malformed Unity 3D objects embedded in PDF files. CVE-2026-57248 has a CVSS score of 7.8, High severity. It resolves insufficient object type and argument validation during JavaScript annotation processing that could corrupt internal structures and crash the application. CVE-2026-57246 has a CVSS score of 7.8, High severity. It fixes inadequate argument validation during signature verification that could lead to unsafe memory operations when processing abnormal strings.
No verified real-world exploitation or public proof-of-concept has been confirmed for these vulnerabilities.
Key Details
- Affected Product
- Foxit Pdf Editor
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-416