CVE-2026-13126 — Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, result…
Published: 2026-07-08 · CVSS: 7.8 · CVSS 3.1
The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7