Invalid Memory Write in Form Field Parsing Causes Program Crash

Publication date: 2026-04-27

Last updated on: 2026-04-29

Assigner: Foxit

Description

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-27

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5941

EUVD

EUVD-2026-25827

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 14.0.0 (inc) to 14.0.4 (exc)
foxit	pdf_editor	From 2023.0.0 (inc) to 2026.1.1 (exc)
foxit	pdf_reader	to 2026.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is caused by flaws in the parsing logic that lead to non-signature data being incorrectly identified as valid signatures. This happens when processing malformed form field hierarchies, which results in invalid memory writes and program crashes during the construction of internal data structures.

Impact Analysis

The vulnerability can cause program crashes and invalid memory writes, which may lead to denial of service or potentially allow an attacker to execute arbitrary code or corrupt data. The CVSS score indicates high impact on confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-5941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70