Executive brief
Foxit PDF Editor and Reader are widely used applications for viewing and managing PDF documents. A security flaw has been identified where the software fails to properly restrict dangerous commands when running scripts embedded inside a PDF file. If a user opens a specially crafted PDF, an attacker could bypass security protections to run malicious code on the user's computer, potentially leading to data theft or full system compromise.
Technical details
A vulnerability exists in Foxit PDF Editor and Reader due to the improper restriction of dangerous interfaces within the JavaScript sandbox (CWE-829). When the application executes embedded JavaScript, it fails to block certain sensitive APIs, which can be leveraged to load remote scripts. An attacker can exploit this by convincing a user to open a malicious PDF file (User Interaction required). Successful exploitation allows the attacker to escape the sandbox and achieve arbitrary code execution with the privileges of the current user. The CVSS score of 8.6 reflects a high impact on confidentiality, integrity, and availability with a scope change.
Affected products
- Foxit PDF Editor
- Foxit PDF Reader
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory