CVE-2026-5943
Published: 27 April 2026
Summary
CVE-2026-5943 is a high-severity Use After Free (CWE-416) vulnerability in Foxit Pdf Editor. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5943 is a use-after-free vulnerability (CWE-416) affecting Foxit software. The flaw arises from document structural anomalies that cause inconsistencies between page element relationships and internal index states. When scripts trigger document modifications, object reference validity is not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker requires no privileges and can exploit it with low attack complexity, but user interaction is necessary. By providing a malicious document that a user opens and processes—triggering the script-induced modifications—the attacker can achieve high impacts on confidentiality, integrity, and availability.
Foxit has published security bulletins with details on this issue at https://www.foxit.com/support/security-bulletins.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25829
Vulnerability details
Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in client PDF software (Foxit) directly enables exploitation for arbitrary code execution via a malicious document opened by the user.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely identification, reporting, and patching of flaws directly remediates the use-after-free vulnerability in Foxit software, preventing exploitation via malicious documents.
Memory protection safeguards such as ASLR, DEP, and hardened allocators prevent unauthorized code execution from accessing invalid pointers in use-after-free scenarios.
Restricting PDF reader functionality to essentials, such as disabling script execution, prevents the document modifications that trigger the object reference inconsistencies.