According to its version, the Foxit PDF Editor application (previously named Foxit PhantomPDF) installed on the remote Windows host is prior to 13.2.4. It is, therefore affected by multiple vulnerabilities:

  - Document structural anomalies caused inconsistencies between page element relationships and internal index     states. When scripts triggered document modifications, object reference validity was not properly     maintained, leading to a crash when accessing an invalid pointer during page information queries.
    (CVE-2026-5943)

  - Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger     an unhandled std::invalid_argument exception, ultimately causing the program to terminate.
    (CVE-2026-5937)

  - Improper control flow management allows a crafted document action chain to cause modal dialog reentry on     the main thread, resulting in UI freeze and denial of service. (CVE-2026-5938)

  - Calling a function that triggers a UI refresh after removing comments via a script may access an     invalidated object, leading to program crashes. (CVE-2026-5940)

  - Flaws in page lifecycle management allow document structure changes to desynchronize internal component     states, causing subsequent operations to access invalidated objects and crash the program. (CVE-2026-5942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Foxit PDF Editor < 13.2.4 Multiple Vulnerabilities

medium Nessus Plugin ID 310407

Version 1.2