Spoofing attack in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-18622

Vulnerability identifier: #VU144044

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-18622

CWE-ID: CWE-451

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can spoof the document to appear to be properly signed.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Editor for Mac (formerly PhantomPDF)

Install updates from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.6.24111, 14.0.6.33584, 2026.1.3.36551
Foxit PDF Reader for Windows - update to 2026.1.3.36551
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 13.2.6.63484, 14.0.6.69341, 2026.1.3.70306

• https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2026.1.3+and+Foxit+PDF+Editor+2026.1.3%2F14.0.6%2F13.2.62026-08-13+00%3A00%3A00

• Spoofing attack in Foxit PDF Reader and Editor for Windows
• Spoofing attack in Foxit PDF Reader and Editor for macOS