CVE-2026-13128: Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability
Published Jul 8, 2026
·Updated
Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.
Affected Software
9 affected components
Foxit Foxit PDF Editor/Reader
All of the following
Any of the following
Foxit PDF Editor<=13.2.4.24048
Foxit PDF Editor>=14.0.0.33046<=14.0.4.33508
Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028
Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687
Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737
Foxit PDF Editor>=2026.1.0.36452<=2026.1.1.36485
Foxit PDF Reader<=2026.1.1.36485
Microsoft Windows
Event History
Jul 8, 2026
CVE Published
via MITRE·07:36 AM
Data Sourced
via MITRE·07:36 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-13128?
CVE-2026-13128 has a high severity score of 7.8.
2
How do I fix CVE-2026-13128?
To mitigate CVE-2026-13128, update to the latest version of Foxit PDF Editor/Reader as soon as it is available.
3
What causes the CVE-2026-13128 vulnerability?
CVE-2026-13128 is caused by a use-after-free issue triggered by embedding JavaScript in a PDF file.
4
What are the potential impacts of CVE-2026-13128?
Exploitation of CVE-2026-13128 can lead to remote code execution, causing application crashes and data exposure.
5
Who is affected by CVE-2026-13128?
Users of Foxit PDF Editor/Reader are affected by CVE-2026-13128 due to the vulnerability in the software.