Use-after-free in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-3779

Vulnerability identifier: #VU124717

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-3779

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in document handling when processing certain PDFs with JavaScript. A remote attacker can trick the victim into opening a specially crafted PDF to execute arbitrary code.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Editor for Mac (formerly PhantomPDF)
Foxit PDF Reader for Mac

Install security update from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.3.24041, 14.0.3.33502, 2026.1.0.36452
Foxit PDF Reader for Windows - update to 2026.1.0.36452
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 13.2.3.63444, 14.0.3.69295, 2026.1.0.70169
Foxit PDF Reader for Mac - update to 2026.1.0.70169

• https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2026.1+and+Foxit+PDF+Editor+2026.12026-03-31+00%3A00%3A00

• Multiple vulnerabilities in Foxit PDF Reader and PDF Editor for Windows
• Multiple vulnerabilities in Foxit PDF Editor and Reader for Mac