Foxit PDF Reader Vulnerability Allows Remote Code Execution via Annotation Flaw
A use-after-free vulnerability in Foxit PDF Reader's Annotation handling allows remote attackers to execute arbitrary code on vulnerable systems.
Zero Day Initiative has disclosed a critical use-after-free vulnerability affecting Foxit PDF Reader, identified as CVE-2026-91818. This flaw, rated with a CVSS score of 7.8, allows remote attackers to achieve arbitrary code execution on vulnerable systems.
Exploitation of this vulnerability requires user interaction. Attackers can trick victims into visiting a malicious webpage or opening a specially crafted PDF file to trigger the exploit. Once initiated, the vulnerability allows for code execution within the context of the current process, potentially leading to a full system compromise.
The root cause of the vulnerability lies in how Foxit PDF Reader handles Annotation objects. Specifically, the software fails to adequately validate the existence of an object before attempting to perform operations on it. This oversight creates a window where a use-after-free condition can be triggered, leading to memory corruption and subsequent code execution.
Foxit has acknowledged the vulnerability and has released an update to address the issue. Users are strongly advised to update their Foxit PDF Reader installations to the latest version to mitigate the risk. Further details on the security bulletin can be found on Foxit's official support page.
The vulnerability was reported to Foxit on September 9, 2026, and the advisory was publicly released on September 23, 2026, following coordinated disclosure efforts. The disclosure timeline indicates a prompt response from both the researchers and the vendor.
This vulnerability adds to a growing list of security issues found in widely used PDF readers. PDF documents, while ubiquitous for document sharing, can serve as a potent attack vector if parsing and rendering components contain exploitable flaws. The use-after-free vulnerability type is particularly concerning due to its potential for reliable exploitation leading to code execution.
Users should maintain vigilance when opening PDF files from untrusted sources and ensure their PDF reader software is kept up-to-date. The widespread adoption of Foxit PDF Reader means that this vulnerability could affect a significant number of users if left unpatched.
This advisory serves as a reminder of the ongoing need for robust security practices in software development, particularly for applications that handle complex file formats and are frequently targeted by attackers.