Vulnerabilities

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Oracle

Product

java

CVSS

7.8

Exposure class

Endpoint security

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-91818 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 23 Sep 2026

   A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations.

   CVSS 7.8 CVE-2026-91816 Oracle
2. 8
   CVE NVD 23 Sep 2026

   A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents.

   CVSS 5.3 CVE-2026-91814 Foxit / Nitro / PDF-XChange
3. 15
   CVE NVD 23 Sep 2026

   A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields.

   CVSS 7.8 CVE-2026-91809 Foxit / Nitro / PDF-XChange
4. 15
   CVE NVD 23 Sep 2026

   A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields.

   CVSS 7.8 CVE-2026-91806 Oracle
5. 15
   CVE NVD 23 Sep 2026

   A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling.

   CVSS 7.8 CVE-2026-91805 Foxit / Nitro / PDF-XChange
6. 15
   CVE NVD 23 Sep 2026

   A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects.

   CVSS 7.8 CVE-2026-91799 Oracle
7. 21
   ZDI advisory ZDI 23 Sep 2026

   Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

   CVSS 7.8 CVE-2026-91818 Foxit / Nitro / PDF-XChange