CVE WatchSep 23, 2026

CVE-2026-91816

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by e

CVSS

7.8

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 23, 2026 · Last modified: Sep 23, 2026 · CWE-416

EPSS · 30d

Not enough EPSS history yet.

Technical description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.

Official references

www.foxit.comhttps://www.foxit.com/support/security-bulletins.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-918187.8 HIG

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.8h CVE-2026-918097.8 HIG

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.8h CVE-2026-918067.8 HIG

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.8h CVE-2026-918057.8 HIG

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash.8h CVE-2026-917997.8 HIG

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.8h CVE-2026-917937.8 HIG

—

———When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.8h