CVE Watch23 sept 2026

CVE-2026-91806

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field re

CVSS

7.8

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 23 sept 2026 · Última mod.: 23 sept 2026 · CWE-416

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.

Referencias oficiales

www.foxit.comhttps://www.foxit.com/support/security-bulletins.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-918187.8 ALT

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.8h CVE-2026-918167.8 ALT

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.8h CVE-2026-918097.8 ALT

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.8h CVE-2026-918057.8 ALT

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash.8h CVE-2026-917997.8 ALT

—

———A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.8h CVE-2026-917937.8 ALT

—

———When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.8h