High severity7.8NVD Advisory· Published Sep 23, 2026· Updated Oct 8, 2026
CVE-2026-91806
CVE-2026-91806
Description
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*range: <=13.2.5.63482
- (no CPE)
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*range: <=2026.2.0.39747
- (no CPE)
Patches
Vulnerability mechanics
References
1- www.foxit.com/support/security-bulletins.htmlnvdVendor Advisory
News mentions
2- Foxit PDF Editor/Reader: 23 Vulnerabilities Disclosed in Single Batch, Affecting Multiple ComponentsVypr Intelligence · Sep 23, 2026
- ZDI-26-735: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure VulnerabilityZero Day Initiative · Sep 23, 2026