CVE-2026-13126Disclosure(foxit / pdf_editor)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pdf_editor
  • pdf_reader
  • windows

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-08); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Products
pdf_editorpdf_readerwindows

1 version affected across 3 products

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-08: 2Mentions · 2026-08-25: 1Technical Details · 2026-07-08: 2Technical Details · 2026-08-25: 107-0808-25
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-082
Disclosure1General1
2026-08-251
Disclosure1
Full discourse3 posts
  • CVE@CVEnew
    General

    CVE-2026-13126 The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotati… https://www.cve.org/CVERecord?id=CVE-2026-13126

    Post summary

    The entry describes the technical behavior of CVE-2026-13126, indicating how the injected JavaScript corrupts PDF objects, but it does not mention PoC, exploit code, active attacks, or mitigations.

    01111769
    57.8K followersView on X
  • SystemTek - Technology news website@SystemTek_UK
    Disclosure

    Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVE-2026-13126) https://www.systemtek.co.uk/2026/08/foxit-pdf-reader-annotation-use-after-free-remote-code-execution-vulnerability-cve-2026-13126/ via @SystemTek_UK

    Post summary

    A new CVE-2026-13126 vulnerability in Foxit PDF Reader has been disclosed as a use-after-free remote code execution flaw.

    0000065
    1.8K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-13126 The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotati… https://www.cve.org/CVERecord?id=CVE-2026-13126 ----- Traducción: CVE-2026-13126 El … http://infoflow.cloud`

    Post summary

    A brief disclosure of CVE‑2026‑13126, describing how embedded JavaScript in a PDF deletes pages and produces an invalid object, with no exploit, PoC, or patch information provided.

    0000032
    91 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appfoxitpdf_editor---
Appfoxitpdf_reader---
OSmicrosoftwindows---

Explore more