Foxit Patches 20 Code Execution Vulnerabilities in PDF Reader and Editor
9 min. read 
Published on
Foxit has released security updates for Foxit PDF Reader and Foxit PDF Editor to fix 20 vulnerabilities that could allow attackers to execute code through malicious PDF files.
The fixes arrived on July 8, 2026, as part of the company’s Foxit security bulletin for Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2 on Windows. Foxit also released updated macOS builds for affected Mac products.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
The most important risk is document-based attack delivery. A victim may receive a crafted PDF by email, messaging app, file-sharing service, or web download, then trigger exploitation by opening the file in an affected Foxit product.
What Foxit fixed
The July update addresses a large group of memory-safety and parsing flaws. Many of them involve use-after-free bugs, which occur when an application tries to access memory after it has already been released.
Foxit also patched buffer copy, invalid pointer, array index validation, type confusion, out-of-bounds write, out-of-bounds read, and XML external entity issues. Some flaws can lead to code execution, while others can expose information or crash the application.
The Tenable plugin pipeline entry for the same release tracks the update as security fixes for Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2, listing 28 related CVEs.
| Category | Number of CVEs in the Windows 2026.1.2 bulletin | Main impact |
|---|---|---|
| Potential arbitrary code execution | 20 | Attackers may run code after a victim opens a crafted PDF |
| Local privilege escalation | 1 | Attackers may abuse the update path to gain SYSTEM rights |
| Information disclosure | 7 | Attackers may crash the app or expose data through malformed content |
| Total listed CVEs | 28 | Security and stability fixes across PDF parsing and update handling |
Why the update is urgent
PDF readers remain a common target because users routinely open documents from outside senders. Attackers do not need to compromise a website or system first if they can convince a user to open a weaponized file.
Several Foxit flaws in this release carry CVSS scores of 7.8 and are marked Important by Foxit. That score reflects high confidentiality, integrity, and availability impact, with exploitation requiring user interaction.
One example is CVE-2026-13126, a use-after-free issue involving embedded JavaScript in a PDF. NVD says the crafted JavaScript can delete pages, make an object invalid, and crash the application during a write operation.
Major vulnerability types
The largest group of code execution issues involves use-after-free vulnerabilities. These bugs can become dangerous when attackers control document content that influences how the application frees, reuses, or dereferences internal objects.
Other flaws involve malformed PDF structures, abnormal annotations, signature fields, page trees, embedded JavaScript, Unity 3D content, PRC streams, and XDP documents disguised as PDFs. That range matters because malicious PDFs can hide attack logic in many document features.
The CVE record for CVE-2026-57260 describes an out-of-bounds write issue tied to abnormal Unity 3D content, where the application incorrectly treated part of a malformed object as a valid address.
| CVE group | Weakness type | Impact listed by Foxit |
|---|---|---|
| CVE-2026-13126 to CVE-2026-13129 | Use after free | Potential arbitrary code execution |
| CVE-2026-57237, 57238, 57240, 57242, 57244, 57245, 57247, 57249, 57250, 57252, 57256 | Use after free | Potential arbitrary code execution |
| CVE-2026-57246 | Buffer copy without checking input size | Potential arbitrary code execution |
| CVE-2026-57248 | Release of invalid pointer or reference | Potential arbitrary code execution |
| CVE-2026-57251 | Improper validation of array index | Potential arbitrary code execution |
| CVE-2026-57254 | Type confusion | Potential arbitrary code execution |
| CVE-2026-57260 | Out-of-bounds write | Potential arbitrary code execution |
The update also fixes a privilege escalation flaw
Foxit also fixed CVE-2026-57239, a local privilege escalation issue in the update process. This flaw is separate from the malicious PDF parsing bugs.
According to Foxit, the update service could execute user-controllable executable files with elevated privileges. That could allow an unprivileged local user to obtain NT AUTHORITY\SYSTEM rights or load untrusted code into memory.
This issue carries a higher listed score than many of the PDF parsing bugs, with Foxit assigning it 8.2. That makes the release important for endpoint hardening, not only document-opening risk.
Affected Foxit versions
On Windows, Foxit PDF Reader 2026.1.1.36485 and earlier are affected. Foxit PDF Editor is affected across several branches, including earlier 2026.x, 2025.x, 2024.x, 2023.x, 14.x, and some 13.x builds.
On macOS, Foxit released Foxit PDF Editor for Mac 2026.1.2 and 14.0.5, along with Foxit PDF Reader for Mac 2026.1.2. The Mac bulletin lists affected 2026.x, 2025.x, 2024.x, 2023.x, 14.x, and older 13.x Editor builds, plus Reader for Mac 2026.1.1.70276 and earlier.
Because product branches differ, administrators should check the installed product name, platform, and exact build number before deciding whether a device is patched.
| Product | Patched version | Platform |
|---|---|---|
| Foxit PDF Reader | 2026.1.2 | Windows |
| Foxit PDF Editor | 2026.1.2 | Windows |
| Foxit PDF Editor | 14.0.5 | Windows |
| Foxit PDF Reader for Mac | 2026.1.2 | macOS |
| Foxit PDF Editor for Mac | 2026.1.2 or 14.0.5 | macOS |
| Foxit PDF Editor for Mac 13.x branch | 13.2.5 | macOS |
How attackers could exploit these bugs
The most likely attack path is phishing. An attacker sends a PDF that contains specially crafted JavaScript, annotations, form data, 3D content, page structures, or other malformed objects that trigger a vulnerable parser path.
If the victim opens the file in an affected Foxit build, the bug may crash the application, disclose information, or execute code in the context of the user. The exact result depends on the vulnerability and the attacker’s exploit reliability.
The risk is higher for employees who regularly handle invoices, contracts, forms, resumes, purchase orders, legal files, shipping documents, or support attachments from outside senders.
- Do not open unexpected PDF attachments from unknown senders.
- Be cautious with PDFs that ask users to enable scripts, trust 3D content, or interact with unusual forms.
- Patch before opening documents from email, Teams, Slack, web forms, or file-sharing links.
- Use endpoint protection that can scan PDFs before opening them.
- Limit local admin rights so document exploits have less impact.
Researcher credits
Foxit credited multiple researchers and groups for the reports behind this release. The acknowledgements include Anonymous working with TrendAI Zero Day Initiative, XuPeng, KPC of Cisco Talos, Luke Paris, Liang Zhu, Roddy Chow, and Trung Nguyen of Cystack.
Those credits show that the release combines reports from several research channels. It also suggests that attackers may eventually receive enough public information to build weaponized documents if users delay patching.
The CVE-2026-57260 record is one example of how individual issue descriptions can reveal the affected document feature, in this case malformed Unity 3D object handling.
How to update Foxit PDF Reader and Editor
Foxit recommends updating through the application itself. Users can open Foxit PDF Reader or Foxit PDF Editor, go to Help, open About Foxit PDF Reader or About Foxit PDF Editor, then choose Check for Update.
Administrators can also download updated builds from Foxit’s website and deploy them through software management tools. Enterprise teams should confirm that both Reader and Editor are covered, especially where older 14.x or 13.x Editor branches remain in use.
The official Foxit advisory lists the affected versions and update paths for Windows and macOS, including the 2026.1.2 and 14.0.5 releases.
- Open Foxit PDF Reader or Foxit PDF Editor.
- Go to Help.
- Select About Foxit PDF Reader or About Foxit PDF Editor.
- Click Check for Update.
- Install the latest available version.
- Restart the application after the update finishes.
- Confirm the installed version matches the patched branch for your platform.
What security teams should do now
Organizations should treat this as a priority endpoint update. PDF readers sit directly between users and untrusted files, which makes patch delays risky during phishing campaigns.
Teams should inventory Foxit installations, identify unmanaged devices, and prioritize users who process external documents every day. That includes finance, legal, HR, procurement, customer support, sales, insurance, and public-facing intake teams.
The Tenable detection entry confirms plugin work for this Foxit update, which should help vulnerability management teams track exposure once scanner content reaches their environment.
- Deploy Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2 where applicable.
- Update older Foxit PDF Editor branches to the patched 14.0.5 or supported 13.x builds if needed.
- Patch Foxit PDF Reader for Mac and Foxit PDF Editor for Mac on managed macOS fleets.
- Block untrusted PDFs from reaching high-risk users where possible.
- Review endpoint logs for crashes or suspicious child processes launched by Foxit applications.
- Restrict JavaScript and 3D trust settings for PDFs if business workflows allow it.
The bottom line
Foxit’s July 2026 update is more than a routine stability release. It fixes 20 potential arbitrary code execution flaws and several other security issues across PDF parsing and the update mechanism.
Most attacks would still require a victim to open a malicious PDF, but that is a realistic threat model. PDF attachments remain common in business communication, and attackers often disguise weaponized files as invoices, contracts, forms, or HR documents.
Users and administrators should update Foxit PDF Reader and Foxit PDF Editor before opening untrusted PDFs. Security teams should also verify patch deployment across Windows and macOS systems, not only on the newest 2026.x branch.
The NVD record for CVE-2026-13126 illustrates the broader issue: document features such as embedded JavaScript can drive memory corruption when PDF readers fail to validate object state correctly.
FAQ
Foxit’s Windows 2026.1.2 bulletin lists 28 CVEs overall. Of those, 20 are potential arbitrary code execution issues, while the rest include local privilege escalation and information disclosure vulnerabilities.
Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2 fix the latest Windows 2026.x issues. Foxit also released patched versions for older Editor branches and macOS products, including Foxit PDF Editor 14.0.5 and Foxit PDF Reader for Mac 2026.1.2.
Many of the issues can be used in remote attack scenarios if an attacker convinces a victim to open a specially crafted PDF. The CVSS vectors generally require user interaction, so the user opening the malicious file is a key condition.
CVE-2026-57239 is a local privilege escalation vulnerability in the Foxit update mechanism. Foxit says the update service could execute user-controllable executable files with elevated privileges, potentially giving an unprivileged user SYSTEM rights.
Open Foxit PDF Reader or Foxit PDF Editor, go to Help, select About Foxit PDF Reader or About Foxit PDF Editor, and click Check for Update. Administrators can also deploy the latest installers from Foxit’s website.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages