CVE-2026-13128

Radar advisories

• 2026-09-23 ZDI ZDI-26-727: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability Exploitation requires the victim to open a crafted PDF or load a malicious page.
• 2026-08-24 ZDI ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability Exploitation requires the user to open a malicious PDF file or visit a malicious web page.

References

• NVD ↗
• CVE.org ↗
• Zero Day Initiative ↗