CVE-2026-5939

published 2026-04-27

CVE-2026-5939: A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code…

Priority P4 23 medium 5.5 CVSS 3.1

AV L AC L PR N UI R S U C N I N A H

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
foxit	pdf_editor	>= 14.0.0 < 14.0.4	14.0.4
foxit	pdf_editor	>= 2023.0.0 < 2026.1.1	2026.1.1
foxit	pdf_reader	< 2026.1.1	2026.1.1
foxit_software_inc	foxit_pdf_editor	—	—
foxit_software_inc	foxit_pdf_editor	—	—
foxit_software_inc	foxit_pdf_reader	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416