Executive brief
Foxit PDF Editor and Reader failed to properly restrict access to the JavaScript API that lists open documents, allowing a malicious PDF to read sensitive content from other PDFs open in the same application and exfiltrate it. An attacker can exploit this by distributing a specially crafted PDF that, when opened alongside confidential documents, steals and transmits their content.
Technical details
The app.activeDocs JavaScript API does not perform attribute authorization checks, returning full Document objects for all open PDFs within the same process. A trusted malicious PDF can invoke this API to access and extract content from other documents, achieving information disclosure through improper resource exposure (CWE-668). The vulnerability requires user interaction (opening the malicious PDF) and local attack vector, with a fix available in patched versions.
Affected products
- Foxit PDF Reader 2026.2.0.39747 and earlier
- Foxit PDF Editor 2026.2.0.39747 and all previous 2026.x versions, 2025.3.0.35737 and all previous 2025.x versions, 2024.4.1.27687 and all previous 2024.x versions, 2023.3.0.23028 and all previous 2023.x versions, 14.0.7.33751 and all previous 14.x versions, 13.2.6.24111 and earlier
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8