Foxit Products Use-After-Free Vulnerability in XFA PDF Processing Allowing Arbitrary Code Execution

A use-after-free vulnerability has been identified in Foxit PDF Reader and Foxit PDF Editor. This vulnerability arises when the application processes certain XFA PDFs, leading to a crash and potentially allowing arbitrary code execution. The issue is caused by the application accessing invalid objects or pointers that have been deleted without proper validation, during the calculation event processing of the crafted XFA PDF.

Impact

Exploitation of this vulnerability causes the application to crash and could lead to arbitrary code execution.

Remediation

Users can update to Foxit PDF Reader 2026.1.1 or Foxit PDF Editor 2026.1.1/14.0.4. Instructions for updating are available on the Foxit website. For Mac users, Foxit PDF Editor and Foxit PDF Reader have also been released in versions 2026.1, which address this vulnerability.