CVE-2026-5940: Foxit PDF Editor

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

Affected products

• Foxit PDF Editor: before 13.2.4 (fixed in 13.2.4); from 14.0.0, before 14.0.4 (fixed in 14.0.4); from 2023.0.0, before 2026.1.1 (fixed in 2026.1.1)
• Foxit PDF Reader: before 2026.1.1 (fixed in 2026.1.1)

Published 2026-04-27. Last modified 2026-06-17.