CVE-2026-5937

MediumCVSS 5.5/10Last modified Oct 26, 2026

Description

Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1 and earlier; Versions 14.0.3 and earlier; Versions 13.2.3 and earlier
Foxit Software Inc.	Foxit PDF Reader	Versions 2026.1 and earlier

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Apr 27, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-59385.5Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI fr CVE-2026-593852.7A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of CVE-2026-593866.5A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This priv CVE-2026-593878.8The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an CVE-2026-593886.5Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events CVE-2026-59395.5A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting i CVE-2026-593964.9A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it CVE-2026-59405.5Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program cras CVE-2026-59417.1Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leadi CVE-2026-59425.5Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operation CVE-2026-59437.8Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered do CVE-2026-59448.2An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an A