High severity7.8NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-13128

Description

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

Affected products

Foxitsoftware/PDF Editor
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
Range: <=13.2.4.24048
Foxitsoftware/PDF Reader
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
Range: <=2026.1.1.36485
Foxitsoftware/PDFllm-create

Patches

Vulnerability mechanics

References

www.foxit.com/support/security-bulletins.htmlnvdVendor Advisory

News mentions

ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability
Zero Day Initiative · Aug 24, 2026

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000