Security Bulletins

A prompt response to software defects and security vulnerabilities has been, and will continue to be, a top priority for everyone here at Foxit Software. Even though threats are a fact of life, we are proud to support the most robust PDF solutions on the market. Here is information on some enhancements that make our software even more robust.

Get notified of Foxit PDF Editor releases and security bulletins

Security updates available in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8

Release date: September 23, 2026

Foxit has released Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8, which addresses potential security and stability issues.

Foxit PDF Reader (previously named Foxit Reader)

2026.2.0.39747 and earlier

Foxit PDF Editor (previously named Foxit PhantomPDF)

2026.2.0.39747 and all 2026.x versions, 2025.3.0.35737 and all 2025.x versions, 2024.4.1.27687 and all 2024.x versions, 2023.3.0.23028 and all 2023.x versions, 14.0.7.33751 and all 14.x version, 13.2.6.24111 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader or Foxit PDF Editor, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed a potential issue where the application could be exposed to an Exposure of Resource to Wrong Sphere vulnerability when handling certain JavaScript actions, which attackers could exploit to disclose information. This occurs as the application fails to perform proper attribute authorization checks when implementing the “app.activeDocs” JavaScript API and allows it to return full Doc objects for every open document within the same process.

kai63001 working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when handling certain U3D files, PRC files, AcroForms, JPEG/JPEG2000/WebP images, or annotations with malformed streams or data, which attackers could exploit to execute remote code or disclose information. This occurs due to a lack of proper validation of user-supplied data before performing operations on objects, or improper handling of bitmap stride and target buffer formats during WebP image decoding.

Liang Zhu working with TrendAI Zero Day Initiative

Liang Zhu working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

kai63001 working with TrendAI Zero Day Initiative

06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Untrusted Pointer Dereference vulnerability when opening a crafted PDF containing a malicious FOPN_foweb encryption filter with the FileOpen plugin, which attackers could exploit to execute arbitrary code. This occurs due to a lack of proper validation of the encryption metadata, leaving an internal pointer in an invalid state and resulting in chained read and write access violations.

Pwn2Sleep working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Protection Mechanism Failure vulnerability when opening PDFs that contain certain JavaScripts, which attackers could exploit to disclose information. This occurs as the application’s JavaScript API does not enforce Safe Reading Mode permission checks and allows a crafted PDF to trigger external SMB authentication without any security prompts.

Liang Zhu working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an External Control of File Name or Path vulnerability when handling certain PDF portfolios embedded with malicious file paths, which attackers could exploit to execute arbitrary code by writing malicious files to arbitrary locations on the filesystem. This occurs as the application fails to validate the directory traversal path in the attachment filename and directly concatenates and uses the filename referenced by the Filespec entries without sanitization.

Landon Peng (lunbun) of Lunbun LLC working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Incorrect Permission Assignment for Critical Resource, Uncontrolled Path Element, Improper Certificate Validation, or Time-of-Check Time-of-Use (TOCTOU) Race Condition vulnerability during update, which attackers could exploit to execute arbitrary code with elevated privileges. This occurs due to an insecure permission configuration in the update daemon, unsafe loading of dynamic link libraries from a user-writable directory during high-privilege operations, improper validation of the certificate presented by the server, or insufficient file locking and integrity validation during the download and extraction.

praydog & kmx00 working with TrendAI Zero Day Initiative

praydog & kmx00 working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Improper Limitation of a Pathname to a Restricted Directory vulnerability when handling certain RichMedia annotations, which attackers could exploit to execute arbitrary code. This occurs as the application fails to properly validate the file path of the embedded PDF resources prior to using it in file operations.

Liang Zhu working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Improper Verification of Cryptographic Signature vulnerability and could deliver incorrect signature verification information when handling certain signed documents, which attackers could exploit to manipulate document content and deceive users into trusting the manipulated documents. This occurs as the application fails to perform proper validation of cryptographic signatures after the visibility of certain content is dynamically altered during incremental updates.

Jan Slabon (Setasign GmbH & Co. KG), Germany

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor 13.2.7

Release date: September 23, 2026

Foxit has released Foxit PDF Editor 13.2.7, which addresses potential security and stability issues.

Foxit PDF Editor (previously named Foxit PhantomPDF)

13.2.6.24111 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Editor, click on “Help” > “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed a potential issue where the application could be exposed to an Exposure of Resource to Wrong Sphere vulnerability when handling certain JavaScript actions, which attackers could exploit to disclose information. This occurs as the application fails to perform proper attribute authorization checks when implementing the “app.activeDocs” JavaScript API and allows it to return full Doc objects for every open document within the same process.

kai63001 working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when handling certain U3D files, PRC files, AcroForms, JPEG/JPEG2000 images, or annotations with malformed streams or data, which attackers could exploit to execute remote code or disclose information. This occurs due to a lack of proper validation of user-supplied data before performing operations on objects.

Liang Zhu working with TrendAI Zero Day Initiative

Liang Zhu working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

kai63001 working with TrendAI Zero Day Initiative

06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Untrusted Pointer Dereference vulnerability when opening a crafted PDF containing a malicious FOPN_foweb encryption filter with the FileOpen plugin, which attackers could exploit to execute arbitrary code. This occurs due to a lack of proper validation of the encryption metadata, leaving an internal pointer in an invalid state and resulting in chained read and write access violations.

Pwn2Sleep working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Protection Mechanism Failure vulnerability when opening PDFs that contain certain JavaScripts, which attackers could exploit to disclose information. This occurs as the application’s JavaScript API does not enforce Safe Reading Mode permission checks and allows a crafted PDF to trigger external SMB authentication without any security prompts.

Liang Zhu working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an External Control of File Name or Path vulnerability when handling certain PDF portfolios embedded with malicious file paths, which attackers could exploit to execute arbitrary code by writing malicious files to arbitrary locations on the filesystem. This occurs as the application fails to validate the directory traversal path in the attachment filename and directly concatenates and uses the filename referenced by the Filespec entries without sanitization.

Landon Peng (lunbun) of Lunbun LLC working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Incorrect Permission Assignment for Critical Resource, Improper Certificate Validation, or Time-of-Check Time-of-Use (TOCTOU) Race Condition vulnerability during update, which attackers could exploit to execute arbitrary code with elevated privileges. This occurs due to an insecure permission configuration in the update daemon, improper validation of the certificate presented by the server, or insufficient file locking and integrity validation during the download and extraction.

praydog & kmx00 working with TrendAI Zero Day Initiative

praydog & kmx00 working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Improper Limitation of a Pathname to a Restricted Directory vulnerability when handling certain RichMedia annotations, which attackers could exploit to execute arbitrary code. This occurs as the application fails to properly validate the file path of the embedded PDF resources prior to using it in file operations.

Liang Zhu working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Improper Verification of Cryptographic Signature vulnerability and could deliver incorrect signature verification information when handling certain signed documents, which attackers could exploit to manipulate document content and deceive users into trusting the manipulated documents. This occurs as the application fails to perform proper validation of cryptographic signatures after the visibility of certain content is dynamically altered during incremental updates.

Jan Slabon (Setasign GmbH & Co. KG), Germany

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor for Mac 2026.2.1/14.0.8 and Foxit PDF Reader for Mac 2026.2.1

Release date: September 23, 2026

Foxit has released Foxit PDF Editor for Mac 2026.2.1/14.0.8 and Foxit PDF Reader for Mac 2026.2.1, which addresses potential security and stability issues.

Foxit PDF Editor for Mac (previously named Foxit PhantomPDF Mac )

2026.2.0.72029 and all 2026.x versions, 2025.3.0.69570 and all 2025.x versions, 2024.4.1.66479 and all 2024.x versions, 2023.3.0.63083 and all 2023.x versions, 14.0.7.69441 and all 14.x versions, 13.2.6.63484 and earlier

Foxit PDF Reader for Mac (previously named Foxit Reader Mac )

2026.2.0.72029 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader for Mac or Foxit PDF Editor for Mac, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed a potential issue where the application could be exposed to an Exposure of Resource to Wrong Sphere vulnerability when handling certain JavaScript actions, which attackers could exploit to disclose information. This occurs as the application fails to perform proper attribute authorization checks when implementing the “app.activeDocs” JavaScript API and allows it to return full Doc objects for every open document within the same process.

kai63001 working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when handling certain PRC files or images with malformed streams or data, which attackers could exploit to execute remote code or disclose information. This occurs due to a lack of proper validation of user-supplied data before performing operations on objects.

Liang Zhu working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

kai63001 working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Incorrect Permission Assignment for Critical Resource vulnerability during installation or update, which attackers could exploit to execute arbitrary code with elevated privileges. This occurs due to an insecure permission configuration in the update daemon, or insufficient validation of a user-modifiable configuration value during high-privilege upgrades.

Kun Peeks (@SwayZGl1tZyyy)

Addressed a potential issue where the application could be exposed to an Improper Verification of Cryptographic Signature vulnerability and could deliver incorrect signature verification information when handling certain signed documents, which attackers could exploit to manipulate document content and deceive users into trusting the manipulated documents. This occurs as the application fails to perform proper validation of cryptographic signatures after the visibility of certain content is dynamically altered during incremental updates.

Jan Slabon (Setasign GmbH & Co. KG), Germany

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor for Mac 13.2.7

Release date: September 23, 2026

Foxit has released Foxit PDF Editor for Mac 13.2.7, which addresses potential security and stability issues.

Foxit PDF Editor for Mac (previously named Foxit PhantomPDF Mac )

13.2.6.63484 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Editor for Mac, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed a potential issue where the application could be exposed to an Exposure of Resource to Wrong Sphere vulnerability when handling certain JavaScript actions, which attackers could exploit to disclose information. This occurs as the application fails to perform proper attribute authorization checks when implementing the “app.activeDocs” JavaScript API and allows it to return full Doc objects for every open document within the same process.

kai63001 working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when handling certain PRC files or images with malformed streams or data, which attackers could exploit to execute remote code or disclose information. This occurs due to a lack of proper validation of user-supplied data before performing operations on objects.

Liang Zhu working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

kai63001 working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Incorrect Permission Assignment for Critical Resource vulnerability during update, which attackers could exploit to execute arbitrary code with elevated privileges. This occurs due to an insecure permission configuration in the update daemon.

Addressed a potential issue where the application could be exposed to an Improper Verification of Cryptographic Signature vulnerability and could deliver incorrect signature verification information when handling certain signed documents, which attackers could exploit to manipulate document content and deceive users into trusting the manipulated documents. This occurs as the application fails to perform proper validation of cryptographic signatures after the visibility of certain content is dynamically altered during incremental updates.

Jan Slabon (Setasign GmbH & Co. KG), Germany

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Reader 2026.1.3 and Foxit PDF Editor 2026.1.3/14.0.6/13.2.6

Release date: August 13, 2026

Foxit has released Foxit PDF Reader 2026.1.3 and Foxit PDF Editor 2026.1.3/14.0.6/13.2.6, which addresses potential security and stability issues.

Foxit PDF Reader (previously named Foxit Reader)

2026.1.2.36540 and earlier

Foxit PDF Editor (previously named Foxit PhantomPDF)

2026.1.2.36540 and all 2026.x versions, 2025.3.0.35737 and all 2025.x versions, 2024.4.1.27687 and all 2024.x versions, 2023.3.0.23028 and all 2023.x versions, 14.0.5.33580 and all 14.x version, 13.2.5.24109 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader or Foxit PDF Editor, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed a potential issue where the application could deliver inconsistent signature verification information to users when handling certain signed documents, which attackers could exploit to manipulate document content and mislead users into trusting the manipulated documents. This occurs as the application UI fails to accurately reflect the true integrity status of the signatures when signature fields are abnormally modified – such as through changes to appearance, coordinates, or field duplication.

Enzo da Rosa Brum, Frederico Schardong, and Ricardo Felipe Custódio, all of the Computer Security Laboratory (LabSEC), Federal University of Santa Catarina (UFSC), Brazil

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor for Mac 2026.1.3/14.0.6/13.2.6 and Foxit PDF Reader for Mac 2026.1.3

Release date: August 13, 2026

Foxit has released Foxit PDF Editor for Mac 2026.1.3/14.0.6/13.2.6 and Foxit PDF Reader for Mac 2026.1.3, which addresses potential security and stability issues.

Foxit PDF Editor for Mac (previously named Foxit PhantomPDF Mac )

2026.1.2.70304 and all 2026.x versions, 2025.3.0.69570 and all 2025.x versions, 2024.4.1.66479 and all 2024.x versions, 2023.3.0.63083 and all 2023.x versions, 14.0.5.69339 and all 14.x versions, 13.2.5.63482 and earlier

Foxit PDF Reader for Mac (previously named Foxit Reader Mac )

2026.1.2.70304 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader for Mac or Foxit PDF Editor for Mac, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed a potential issue where the application could deliver inconsistent signature verification information to users when handling certain signed documents, which attackers could exploit to manipulate document content and mislead users into trusting the manipulated documents. This occurs as the application UI fails to accurately reflect the true integrity status of the signatures when signature fields are abnormally modified – such as through changes to appearance, coordinates, or field duplication.

Enzo da Rosa Brum, Frederico Schardong, and Ricardo Felipe Custódio, all of the Computer Security Laboratory (LabSEC), Federal University of Santa Catarina (UFSC), Brazil

For more information, please the Foxit Security Response Team at [email protected] .

Foxit PDF Services API security update

Release date: July 27, 2026

Foxit PDF Services API has been updated to address a security issue. No customer action is required.

Vulnerability details

Addressed a potential issue where the service could be exposed to a Server-Side Request Forgery (SSRF) vulnerability when creating PDFs from URLs, which attackers could exploit to disclose information the internal server of the service. This occurs as the service supports referencing external files but does not properly re-validate the target URL after following HTTP redirects.

This issue has been resolved by implementing strict validation of input URLs before processing requests. No customer action is required.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2

Release date: July 8, 2026

Foxit has released Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2, which addresses potential security and stability issues.

Foxit PDF Reader (previously named Foxit Reader)

2026.1.1.36485 and earlier

Foxit PDF Editor (previously named Foxit PhantomPDF)

2026.1.1.36485 and all 2026.x versions, 2025.3.0.35737 and all 2025.x versions, 2024.4.1.27687 and all 2024.x versions, 2023.3.0.23028 and all 2023.x versions, 14.0.4.33508 and all 14.x version, 13.2.4.24048 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader or Foxit PDF Editor, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling PDFs embedded with certain JavaScript, which attackers could exploit to execute remote code or disclose information. This occurs as the application uses or accesses an invalid object or pointer, reads an illegal memory address, calls on a damaged object, or accesses internal members of invalid or improperly initialized fields without proper prior validation.

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Local Privilege Escalation vulnerability when checking for updates, which attackers could exploit to execute malicious DLL files. This occurs as the Foxit update service executes user-controllable executable files with elevated privileges, which allows unprivileged users to obtain “NT AUTHORITY\SYSTEM” rights and untrusted code to be loaded into memory.

Luke Paris (@Paradoxis)

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read vulnerability and crash when parsing certain PDFs containing abnormal page trees, image objects, or color spaces, which attackers could exploit to disclose information. This occurs due to access to an invalid address, an invalid image buffer pointer, or an illegal pointer as the application fails to verify the page information after JavaScript is executed, incorrectly processes malformed image buffers, or does not validate outputs from semantically malformed color space functions.

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Buffer Copy without Checking Size of Input vulnerability and crash when handling certain PDFs containing abnormal signature fields or annotation objects, which attackers could exploit to execute arbitrary code. This occurs as the application fails to perform sufficient consistency checks on objects and to validate arguments when copying abnormal strings.

Addressed potential issues where the application could be exposed to a Release of Invalid Pointer or Reference/Improper Validation of Array Index vulnerability and crash when handling certain PDFs embedded with JavaScript to modify annotation attributes, which attackers could exploit to execute arbitrary code. This occurs due to insufficient checks on the object type, upper bounds, or consistency between the input parameters and the internal data structure.

Addressed a potential issue where the application could be exposed to a Type Confusion vulnerability and crash when parsing certain PDFs containing abnormal annotations, which attackers could exploit to execute arbitrary code. This occurs as the application uses corrupted or improperly initialized internal variables of the Popup object without proper validation after the page annotation is destroyed by JavaScript execution.

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when opening certain PDFs containing a malformed PRC stream or an abnormal Unity 3D object with 3D content trust enabled, which attackers could exploit to disclose information or execute arbitrary code. This occurs as the application fails to perform sufficient boundary verification for the PRC entity index, unconditionally trusts the constructed file structure description information without proper validation, or incorrectly resolves a portion of the abnormal object as a pointer and uses it as a valid address.

Addressed a potential issue where the application could be exposed to an Improper Restriction of XML External Entity Reference vulnerability when parsing crafted XDP documents that are disguised as PDF files, which attackers could exploit to disclose information. This occurs as the application parses attacker-controlled XDP/XML with external entity resolution enabled, without implementing sufficient security measures in its XML parsing logic.

Trung Nguyen (@everping) of Cystack

Foxit would also like to thank XuPeng and Liang Zhu for reporting specific stability issues in certain environments or scenarios to help us improve our products.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor 14.0.5

Release date: July 8, 2026

Foxit has released Foxit PDF Editor 14.0.5, which addresses potential security and stability issues.

Foxit PDF Editor (previously named Foxit PhantomPDF)

14.0.4.33508 and all 14.x version, 13.2.4.24048 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Editor, click on “Help” > “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling PDFs embedded with certain JavaScript, which attackers could exploit to execute remote code or disclose information. This occurs as the application uses or accesses an invalid object or pointer, reads an illegal memory address, calls on a damaged object, or accesses internal members of invalid or improperly initialized fields without proper prior validation.

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Local Privilege Escalation vulnerability when checking for updates, which attackers could exploit to execute malicious DLL files. This occurs as the Foxit update service executes user-controllable executable files with elevated privileges, which allows unprivileged users to obtain “NT AUTHORITY\SYSTEM” rights and untrusted code to be loaded into memory.

Luke Paris (@Paradoxis)

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read vulnerability and crash when parsing certain PDFs containing abnormal page trees, image objects, or color spaces, which attackers could exploit to disclose information. This occurs due to access to an invalid address, an invalid image buffer pointer, or an illegal pointer as the application fails to verify the page information after JavaScript is executed, incorrectly processes malformed image buffers, or does not validate outputs from semantically malformed color space functions.

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Buffer Copy without Checking Size of Input vulnerability and crash when handling certain PDFs containing abnormal signature fields or annotation objects, which attackers could exploit to execute arbitrary code. This occurs as the application fails to perform sufficient consistency checks on objects and to validate arguments when copying abnormal strings.

Addressed potential issues where the application could be exposed to a Release of Invalid Pointer or Reference/Improper Validation of Array Index vulnerability and crash when handling certain PDFs embedded with JavaScript to modify annotation attributes, which attackers could exploit to execute arbitrary code. This occurs due to insufficient checks on the object type, upper bounds, or consistency between the input parameters and the internal data structure.

Addressed a potential issue where the application could be exposed to a Type Confusion vulnerability and crash when parsing certain PDFs containing abnormal annotations, which attackers could exploit to execute arbitrary code. This occurs as the application uses corrupted or improperly initialized internal variables of the Popup object without proper validation after the page annotation is destroyed by JavaScript execution.

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when opening certain PDFs containing a malformed PRC stream or an abnormal Unity 3D object with 3D content trust enabled, which attackers could exploit to disclose information or execute arbitrary code. This occurs as the application fails to perform sufficient boundary verification for the PRC entity index, unconditionally trusts the constructed file structure description information without proper validation, or incorrectly resolves a portion of the abnormal object as a pointer and uses it as a valid address.

Addressed a potential issue where the application could be exposed to an Improper Restriction of XML External Entity Reference vulnerability when parsing crafted XDP documents that are disguised as PDF files, which attackers could exploit to disclose information. This occurs as the application parses attacker-controlled XDP/XML with external entity resolution enabled, without implementing sufficient security measures in its XML parsing logic.

Trung Nguyen (@everping) of Cystack

Foxit would also like to thank XuPeng and Liang Zhu for reporting specific stability issues in certain environments or scenarios to help us improve our products.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor 13.2.5

Release date: July 8, 2026

Foxit has released Foxit PDF Editor 13.2.5, which addresses potential security and stability issues.

Foxit PDF Editor (previously named Foxit PhantomPDF)

13.2.4.24048 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Editor, click on “Help” > “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling PDFs embedded with certain JavaScript, which attackers could exploit to execute remote code or disclose information. This occurs as the application uses or accesses an invalid object or pointer, reads an illegal memory address, calls on a damaged object, or accesses internal members of invalid or improperly initialized fields without proper prior validation.

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Local Privilege Escalation vulnerability when checking for updates, which attackers could exploit to execute malicious DLL files. This occurs as the Foxit update service executes user-controllable executable files with elevated privileges, which allows unprivileged users to obtain “NT AUTHORITY\SYSTEM” rights and untrusted code to be loaded into memory.

Luke Paris (@Paradoxis)

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read vulnerability and crash when parsing certain PDFs containing abnormal page trees, image objects, or color spaces, which attackers could exploit to disclose information. This occurs due to access to an invalid address, an invalid image buffer pointer, or an illegal pointer as the application fails to verify the page information after JavaScript is executed, incorrectly processes malformed image buffers, or does not validate outputs from semantically malformed color space functions.

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to a Buffer Copy without Checking Size of Input vulnerability and crash when handling certain PDFs containing abnormal signature fields or annotation objects, which attackers could exploit to execute arbitrary code. This occurs as the application fails to perform sufficient consistency checks on objects and to validate arguments when copying abnormal strings.

Addressed potential issues where the application could be exposed to a Release of Invalid Pointer or Reference/Improper Validation of Array Index vulnerability and crash when handling certain PDFs embedded with JavaScript to modify annotation attributes, which attackers could exploit to execute arbitrary code. This occurs due to insufficient checks on the object type, upper bounds, or consistency between the input parameters and the internal data structure.

Addressed a potential issue where the application could be exposed to a Type Confusion vulnerability and crash when parsing certain PDFs containing abnormal annotations, which attackers could exploit to execute arbitrary code. This occurs as the application uses corrupted or improperly initialized internal variables of the Popup object without proper validation after the page annotation is destroyed by JavaScript execution.

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when opening certain PDFs containing a malformed PRC stream or an abnormal Unity 3D object with 3D content trust enabled, which attackers could exploit to disclose information or execute arbitrary code. This occurs as the application fails to perform sufficient boundary verification for the PRC entity index, unconditionally trusts the constructed file structure description information without proper validation, or incorrectly resolves a portion of the abnormal object as a pointer and uses it as a valid address.

Addressed a potential issue where the application could be exposed to an Improper Restriction of XML External Entity Reference vulnerability when parsing crafted XDP documents that are disguised as PDF files, which attackers could exploit to disclose information. This occurs as the application parses attacker-controlled XDP/XML with external entity resolution enabled, without implementing sufficient security measures in its XML parsing logic.

Trung Nguyen (@everping) of Cystack

Foxit would also like to thank XuPeng and Liang Zhu for reporting specific stability issues in certain environments or scenarios to help us improve our products.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor for Mac 2026.1.2/14.0.5 and Foxit PDF Reader for Mac 2026.1.2

Release date: July 8, 2026

Foxit has released Foxit PDF Editor for Mac 2026.1.2/14.0.5 and Foxit PDF Reader for Mac 2026.1.2, which addresses potential security and stability issues.

Foxit PDF Editor for Mac (previously named Foxit PhantomPDF Mac )

2026.1.1.70276 and all 2026.x versions, 2025.3.0.69570 and all 2025.x versions, 2024.4.1.66479 and all 2024.x versions, 2023.3.0.63083 and all 2023.x versions, 14.0.3.69295 and all 14.x versions, 13.2.3.63444 and earlier

Foxit PDF Reader for Mac (previously named Foxit Reader Mac )

2026.1.1.70276 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader for Mac or Foxit PDF Editor for Mac, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling PDFs embedded with certain JavaScript, which attackers could exploit to execute remote code. This occurs as the application uses or accesses an invalid object or pointer, reads an illegal memory address, calls on a damaged object, or accesses internal members of invalid or improperly initialized fields without proper prior validation.

Anonymous working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when opening certain PDFs containing a malformed PRC stream or an abnormal Unity 3D object with 3D content trust enabled, which attackers could exploit to disclose information or execute arbitrary code. This occurs as the application fails to perform sufficient boundary verification for the PRC entity index, unconditionally trusts the constructed file structure description information without proper validation, or incorrectly resolves a portion of the abnormal object as a pointer and uses it as a valid address.

Foxit would also like to thank XuPeng and Liang Zhu for reporting specific stability issues in certain environments or scenarios to help us improve our products.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor for Mac 13.2.5

Release date: July 8, 2026

Foxit has released Foxit PDF Editor for Mac 13.2.5, which addresses potential security and stability issues.

Foxit PDF Editor for Mac (previously named Foxit PhantomPDF Mac )

13.2.3.63444 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Editor for Mac, click on “Help” > “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling PDFs embedded with certain JavaScript, which attackers could exploit to execute remote code. This occurs as the application uses or accesses an invalid object or pointer, reads an illegal memory address, calls on a damaged object, or accesses internal members of invalid or improperly initialized fields without proper prior validation.

Anonymous working with TrendAI Zero Day Initiative

Addressed potential issues where the application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when opening certain PDFs containing a malformed PRC stream or an abnormal Unity 3D object with 3D content trust enabled, which attackers could exploit to disclose information or execute arbitrary code. This occurs as the application fails to perform sufficient boundary verification for the PRC entity index, unconditionally trusts the constructed file structure description information without proper validation, or incorrectly resolves a portion of the abnormal object as a pointer and uses it as a valid address.

Foxit would also like to thank XuPeng and Liang Zhu for reporting specific stability issues in certain environments or scenarios to help us improve our products.

For more information, please the Foxit Security Response Team at [email protected] .

Foxit AI security update

Release date: Jun 15, 2026

Foxit AI ( ) has been updated to address a potential security issue. No customer action is required.

Vulnerability details

Addressed a potential Remote Code Execution vulnerability occurring when specific JavaScript embedded in PDFs is executed within the sandbox environment. This vulnerability arises from the insufficient interception of certain dangerous interfaces, allowing the loading and execution of remote scripts.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Reader 2026.1.1 and Foxit PDF Editor 2026.1.1/14.0.4

Release date: April 27, 2026

Foxit has released Foxit PDF Reader 2026.1.1 and Foxit PDF Editor 2026.1.1/14.0.4, which addresses potential security and stability issues.

Foxit PDF Reader (previously named Foxit Reader)

2026.1.0.36452 and earlier

Foxit PDF Editor (previously named Foxit PhantomPDF)

2026.1.0.36452, 2025.3.0.35737 and all 2025.x versions, 2024.4.1.27687 and all 2024.x versions, 2023.3.0.23028 and all 2023.x versions, 14.0.3.335002 and all 14.x version, 13.2.3.24041 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader or Foxit PDF Editor, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to an Uncaught Exception or Insufficient Control Flow Management vulnerability and crash or freeze when handling tasks related to automatic directory imports, which attackers could exploit to launch a denial of service attack. This occurs due to the insufficient parameter verification that triggers an unhandled exception, or improper control flow management that allows a crafted document action chain to cause modal dialog reentry on the main thread.

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain XFA files, Annotation objects, or Signature objects, which attackers could exploit to execute remote code or disclose information. This occurs due to the access of invalid objects or pointers that have been deleted or destroyed without proper validation.

Haein Lee from KAIST Hacking Lab

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Addressed a potential issue where the application could be exposed to an Improper Input Validation vulnerability and crash when processing malformed form field hierarchies, which attackers could exploit to execute arbitrary code. This is caused by invalid memory writes during the internal data structure construction, resulting from the improper parsing logic that misidentifies the non-signature data as valid signatures.

Anonymous working with TrendAI Zero Day Initiative

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Editor 13.2.4

Release date: April 27, 2026

Foxit has released Foxit PDF Editor 13.2.4, which addresses potential security and stability issues.

Foxit PDF Editor (previously named Foxit PhantomPDF)

13.2.3.24041 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Editor, click on “Help” > “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to an Uncaught Exception or Insufficient Control Flow Management vulnerability and crash or freeze when handling tasks related to automatic directory imports, which attackers could exploit to launch a denial of service attack. This occurs due to the insufficient parameter verification that triggers an unhandled exception, or improper control flow management that allows a crafted document action chain to cause modal dialog reentry on the main thread.

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain Annotation objects or Signature objects, which attackers could exploit to execute remote code or disclose information. This occurs due to the access of invalid objects or pointers that have been deleted or destroyed without proper validation.

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

Anonymous working with TrendAI Zero Day Initiative

For more information, please the Foxit Security Response Team at [email protected] .

Foxit PDF Services API security update

Release date: April 7, 2026

Foxit PDF Services API has been updated to address a security issue. No customer action is required.

Vulnerability details

Addressed a potential issue where the service could be exposed to a Server-Side Request Forgery (SSRF) vulnerability when creating PDFs from URLs, which attackers could exploit to disclose information the internal server of the service and compromise the internal server environment. This occurs due to the insufficient validation of user-supplied URLs so that attackers could control a server-side HTTP request and cause the server to initiate requests to arbitrary destinations.

Vedant Roy of Ultimate Kronos Group (UKG)

This issue has been resolved by implementing strict validation and normalization of input URLs before making any outbound requests. No customer action is required.

For more information, please the Foxit Security Response Team at [email protected] .

Security updates available in Foxit PDF Reader 2026.1 and Foxit PDF Editor 2026.1

Release date: March 31, 2026

Foxit has released Foxit PDF Reader 2026.1 and Foxit PDF Editor 2026.1, which addresses potential security and stability issues.

Foxit PDF Reader (previously named Foxit Reader)

2025.3.0.35737 and earlier

Foxit PDF Editor (previously named Foxit PhantomPDF)

2025.3.0.35737 and all 2025.x versions, 2024.4.1.27687 and all 2024.x versions, 2023.3.0.23028 and all 2023.x versions, 14.0.2.33402 and all 14.x version, 13.2.2.24014 and earlier

Update your applications to the latest versions by following one of the methods below.

In Foxit PDF Reader or Foxit PDF Editor, click on “Help” > “ Foxit PDF Reader” or “ Foxit PDF Editor” > “Check for Update” to update to the latest version.

Vulnerability details

Addressed potential issues where the application could be exposed to an Information Disclosure vulnerability when redacting, encrypting, or printing certain PDFs embedded with specific JavaScript or document/print actions, which attackers could exploit to expose sensitive information to unauthorized actors. This occurs as the existing redaction, encryption, and printing logic does not fully cover the script-driven updates, resulting in certain content remaining unrem...