CVE-2026-5940: Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Published Apr 27, 2026
·Updated
Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.
Affected Software
6 affected components
Foxit Foxit PDF Editor
Foxit Foxit PDF Reader
Foxit PDF Editor<13.2.4
Foxit PDF Editor>=14.0.0<14.0.4
Foxit PDF Editor>=2023.0.0<2026.1.1
Foxit PDF Reader<2026.1.1
Event History
Apr 27, 2026
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeaknessAffected Software
Oct 6, 58306
Event
via FIRST·01:46 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-5940?
CVE-2026-5940 has been identified as a high severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2026-5940?
To fix CVE-2026-5940, ensure you update to the latest version of Foxit PDF Editor or Foxit PDF Reader as provided by the vendor.
3
What type of vulnerability is CVE-2026-5940?
CVE-2026-5940 is classified as a Use-After-Free vulnerability, which can lead to remote code execution.
4
Which software is affected by CVE-2026-5940?
CVE-2026-5940 affects Foxit PDF Editor and Foxit PDF Reader.
5
What can happen if CVE-2026-5940 is exploited?
Exploitation of CVE-2026-5940 can lead to program crashes and potentially allow an attacker to execute arbitrary code remotely.