Filtered by vendor Foxit
Subscribe
Total
390 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-91814 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-29 | N/A | 5.3 MEDIUM |
| A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed. | |||||
| CVE-2026-91798 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-29 | N/A | 8.8 HIGH |
| A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges. | |||||
| CVE-2026-91794 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-29 | N/A | 7.8 HIGH |
| An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution. | |||||
| CVE-2026-91788 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-29 | N/A | 4.7 MEDIUM |
| When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally. | |||||
| CVE-2026-5936 | 1 Foxit | 1 Pdf Services Api | 2026-10-26 | N/A | 8.5 HIGH |
| An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment. | |||||
| CVE-2026-5938 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 5.5 MEDIUM |
| Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service. | |||||
| CVE-2026-5940 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 7.8 HIGH |
| Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes. | |||||
| CVE-2026-5942 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 5.5 MEDIUM |
| Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program. | |||||
| CVE-2026-5941 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 7.8 HIGH |
| Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction. | |||||
| CVE-2026-5939 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 5.5 MEDIUM |
| A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution. | |||||
| CVE-2026-5943 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 7.8 HIGH |
| Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries. | |||||
| CVE-2026-5937 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-10-26 | N/A | 5.5 MEDIUM |
| Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate. | |||||
| CVE-2026-12057 | 1 Foxit | 1 Ai | 2026-10-25 | N/A | 8.6 HIGH |
| When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution. | |||||
| CVE-2026-91800 | 2 Apple, Foxit | 3 Macos, Pdf Editor, Pdf Reader | 2026-10-15 | N/A | 8.8 HIGH |
| A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges. | |||||
| CVE-2026-91807 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-15 | N/A | 6.1 MEDIUM |
| A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash. | |||||
| CVE-2026-91811 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-15 | N/A | 7.8 HIGH |
| A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash. | |||||
| CVE-2025-55309 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 6.7 MEDIUM |
| An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change handling prematurely releases the annotation object, resulting in a use-after-free vulnerability that may cause memory corruption or application crashes. | |||||
| CVE-2025-55310 | 3 Apple, Foxit, Microsoft | 4 Macos, Pdf Editor, Pdf Reader and 1 more | 2026-10-14 | N/A | 7.3 HIGH |
| An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML files used by the StartPage feature can cause the application to load malicious or compromised content upon startup. This may result in information disclosure, unauthorized data access, or other security impacts. | |||||
| CVE-2025-55308 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-14 | N/A | 6.7 MEDIUM |
| An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that calls closeDoc() while internal objects are still in use can cause premature release of these objects. This use-after-free vulnerability may lead to memory corruption, potentially resulting in information disclosure when the PDF is opened. | |||||
| CVE-2025-55314 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-14 | N/A | 7.8 HIGH |
| An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereference of invalid or released memory. This can lead to memory corruption, application crashes, and potentially allow an attacker to execute arbitrary code. | |||||