# CVE-2026-91818: Foxit PDF Editor use-after-free in JavaScript annotation handling

Source: https://junglewise.ai/threats/cve-2026-91818-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91818 · Severity: high · CVSS 7.8 · Published 2026-09-23

Foxit PDF Editor and Reader contain a use-after-free vulnerability in their JavaScript engine when processing PDF annotations. An attacker who crafts a malicious PDF with reentrant page-event code can trigger an application crash. While this does not enable code execution, it allows denial of service against users opening untrusted PDF files.

Technologies: [Foxit PDF Editor](https://junglewise.ai/threats/technologies/pdf-editor), [Foxit PDF Reader](https://junglewise.ai/threats/technologies/pdf-reader). Vendors: [Foxit](https://junglewise.ai/threats/vendors/foxit).

## Quick answers

**Is CVE-2026-91818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91818 being exploited in the wild.

**How severe is CVE-2026-91818?** High severity, with a CVSS score of 7.8, published 23 September 2026.

**Which products and versions are affected?** Foxit PDF Editor 2026.2.0.39747 and earlier, 2025.x through 2025.3.0.35736, 2024.x through 2024.4.1.27686, 2023.x through 2023.3.0.23027, 14.x through 14.0.7.33751, 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.

**Is there a fix for CVE-2026-91818?** A patch was published on 2026-09-23: Fixed in PDF Reader 2026.2.1, PDF Editor 2026.2.1/14.0.8 and later versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91818 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-91818?** Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability occurs in Foxit's JavaScript handling during annotation enumeration, where reentrant page-event processing may release the underlying page object while it is still in use. The use-after-free leads to memory corruption and application crash. Exploitation requires user interaction (opening a crafted PDF) and does not require network or local privileges; a patch is available in versions 2026.2.1, 2025.3.0.35737+, 2024.4.1.27687+, 2023.3.0.23028+, 14.0.8+, and 13.2.6.24111+.

## Affected products

- Foxit PDF Editor 2026.2.0.39747 and earlier, 2025.x through 2025.3.0.35736, 2024.x through 2024.4.1.27686, 2023.x through 2023.3.0.23027, 14.x through 14.0.7.33751, 13.2.6.24111 and earlier
- Foxit PDF Reader 2026.2.0.39747 and earlier

## Timeline

- 2026-09-23: disclosed: CVE-2026-91818 publicly disclosed
- 2026-09-23: patched: Fixed in PDF Reader 2026.2.1, PDF Editor 2026.2.1/14.0.8 and later versions

## References

- [https://www.foxit.com/support/security-bulletins.html](https://www.foxit.com/support/security-bulletins.html)

## Related threats

- [Foxit PDF Editor heap-based out-of-bounds read in JavaScript string handling](https://junglewise.ai/threats/cve-2026-91817-a-heap-based-out-of-bounds-read-vulnerability-exists-in-foxit-pdf)
- [Foxit PDF Editor use-after-free in annotation handling](https://junglewise.ai/threats/cve-2026-91816-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor/Reader out-of-bounds write in JPEG2000 decoding](https://junglewise.ai/threats/cve-2026-91815-foxit-pdf-editor-reader-does-not-perform-sufficient-verification)
- [Foxit PDF Editor and Reader signature validation bypass in incremental updates](https://junglewise.ai/threats/cve-2026-91814-a-signature-validation-vulnerability-exists-in-foxit-pdf-editor)
- [Foxit PDF Reader/Editor update mechanism privilege escalation](https://junglewise.ai/threats/cve-2026-91813-a-vulnerability-in-foxit-pdf-editor-reader-s-update-mechanism)