CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,499 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,499
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product foxit:pdf_editor. Show all products

88 CVEs, showing 51 to 88PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2026-57238High 7.8After the application opened the PDF, JavaScript deleted the form field object.Jul 8, 2026
CVE-2026-57237High 7.8When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid.Jul 8, 2026
CVE-2026-13129High 7.8When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property pat…Jul 8, 2026
CVE-2026-13128High 7.8Embedding JavaScript within a PDF file will cause the page to be deleted.Jul 8, 2026
CVE-2026-13127High 7.8The application opens the PDF file.Jul 8, 2026
CVE-2026-13126High 7.8The embedded JavaScript in the PDF deleted the pages, making the object invalid.Jul 8, 2026
CVE-2026-5943High 7.8Document structural anomalies caused inconsistencies between page element relationships and internal index states.Apr 27, 2026
CVE-2026-5942Medium 5.5Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.Apr 27, 2026
CVE-2026-5941High 7.1Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during inte…Apr 27, 2026
CVE-2026-5940Medium 5.5Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.Apr 27, 2026
CVE-2026-5939Medium 5.5A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.Apr 27, 2026
CVE-2026-5938Medium 5.5Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.Apr 27, 2026
CVE-2026-5937Medium 5.5Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.Apr 27, 2026
CVE-2026-3780High 7.8The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker t…Apr 1, 2026
CVE-2026-3779High 7.8The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when t…Apr 1, 2026
CVE-2026-3778Medium 5.5The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF.Apr 1, 2026
CVE-2026-3777High 7.8The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state.Apr 1, 2026
CVE-2026-3776Medium 5.5The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources.Apr 1, 2026
CVE-2026-3775High 7.8The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricte…Apr 1, 2026
CVE-2026-3774High 7.5The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redacti…Apr 1, 2026
CVE-2025-66499High 7.8A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data.Dec 19, 2025
CVE-2025-66498High 7.8A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing U3D data.Dec 19, 2025
CVE-2025-66497High 7.8A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data.Dec 19, 2025
CVE-2025-66496High 7.8A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data.Dec 19, 2025
CVE-2025-66495High 7.8A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows and MacOS.Dec 19, 2025
CVE-2025-66494High 7.8A use-after-free vulnerability exists in the PDF file parsing of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows.Dec 19, 2025
CVE-2025-66493High 7.8A use-after-free vulnerability exists in the AcroForm handling of Foxit PDF Reader and Foxit PDF Editor before 2025.2.1,14.0.1 and 13.2.1 on Windows .Dec 19, 2025
CVE-2025-13941High 8.8A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service.Dec 19, 2025
CVE-2025-59803Medium 5.3Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers.Dec 11, 2025
CVE-2025-59802High 7.5Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG.Dec 11, 2025
CVE-2025-55314High 7.8An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55313High 7.8An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55312High 7.8An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55311Medium 6.5An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55310High 7.3An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55309Medium 6.7An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55308Medium 6.7An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2.Dec 11, 2025
CVE-2025-55307Low 3.3An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2.Dec 11, 2025
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.