CVE-2026-5940
Published: 27 April 2026
Summary
CVE-2026-5940 is a high-severity Use After Free (CWE-416) vulnerability in Foxit Pdf Editor. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5940 is a use-after-free vulnerability (CWE-416) affecting Foxit software, as detailed in the vendor's security bulletins. The issue arises when a function that triggers a UI refresh is called after comments are removed via a script, resulting in access to an invalidated object and subsequent program crashes. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-04-27T12:16:24.377.
The vulnerability can be exploited by a local attacker requiring low complexity and user interaction, but no special privileges. Successful exploitation enables high impacts on confidentiality, integrity, and availability, potentially allowing severe compromise beyond mere crashes.
Foxit's security advisory at https://www.foxit.com/support/security-bulletins.html provides details on patches and mitigation recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25826
Vulnerability details
Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Foxit client software (PDF/JS handling) enables client-side code execution via malicious file triggering the flaw after script-based comment removal and UI refresh.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely remediation of known flaws, directly addressing this use-after-free vulnerability through application of Foxit vendor patches.
SI-16 implements memory safeguards like ASLR and DEP that protect against exploitation of use-after-free errors by preventing execution from invalidated memory objects.
SI-11 provides error and exception handling to mitigate crashes and potential integrity/compromise from accessing invalidated objects post-comment removal.