CVE-2026-5939 — UAF in Foxit PDF Editor/Reader via XFA calculate event
A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.
Published: 2026-04-27 · CVSS: 5.5 · CVSS 3.1
A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7