CVE-2026-13126 Foxit Software Inc. CVE debrief

Who should care

Users of Foxit PDF software, security teams, and operators of affected systems should review their systems for potential vulnerabilities and implement additional security measures to prevent exploitation. This vulnerability has a high CVSS score of 7.8, indicating high severity, and may require immediate attention to prevent potential attacks.

Technical summary

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing. This vulnerability affects Foxit PDF software and has a high CVSS score of 7.8, indicating high severity. The vulnerability can be exploited through malicious PDFs, potentially leading to program crashes or other unintended behavior.

Defensive priority

High priority due to high CVSS score of 7.8 and potential for exploitation through malicious PDFs.

Recommended defensive actions

• Review and update Foxit PDF software to the latest version
• Verify system configurations for potential vulnerabilities
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited to the CVE record and NVD detail page. Further investigation is required to determine the full scope of the vulnerability, including potential attack vectors and affected systems. Defenders should verify system configurations and review security bulletins for Foxit PDF software.

Official resources