CVE-2026-91791: Use After Free

When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in ...

PT-2026-97224

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue exists in the PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, which causes the application to access released pag...

Foxit PDF Editor for Mac < 13.2.7 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 13.2.7. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on...

PT-2026-97212

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description Opening a specially crafted PDF causes the application to execute scripts that modify annotation rich-text attributes containing malformed font data. During the subsequent...

PT-2026-97438

Name of the Vulnerable Software and Affected Versions JLine versions 3.0.0 through 3.30.14 JLine versions 4.x through 4.3.0 Description The built-in nano editor in JLine handles regex search mode by passing a user-controlled search term from the doSearchString text function in...

PT-2026-97219

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor for macOS affected versions not specified Description An issue in the installer allows a local attacker to gain root privileges. This occurs because the installer does not sufficiently validate a user-modifiable configuration...

CVE-2026-91801: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-91818: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91792: Use After Free

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

Foxit PDF Editor for Mac < 14.0.8 / 2026.2.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 2026.2.1/14.0.8. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied...

PT-2026-97217

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A local privilege escalation issue exists in the update daemon of Foxit PDF Editor/Reader. This is caused by an insecure permission configuration that allows regular users to...

CVE-2026-91796: Protection Mechanism Failure

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials...

CVE-2025-15696: Improper Neutralization of Input During Web Page Generation

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...

CVE-2026-77421: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

CVE-2026-91794: Out-of-bounds Write

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

CVE-2026-91793: Use After Free

When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free...

CVE-2026-91803: Uncontrolled Search Path Element

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges...

CVE-2026-91802: Out-of-bounds Write

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash...

CVE-2026-91804: Out-of-bounds Write

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes...

CVE-2026-91790: Use After Free

When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF...