CVE-2020-13557: Foxit PDF Reader JavaScript engine use-after-free

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with high EPSS and public exploit references, tempered by the requirement that a user open a malicious file.

What it is

Foxit PDF Reader 10.1.0.37527 contains a use-after-free in its JavaScript engine. A crafted PDF can cause reuse of freed memory, which the vendor and reporting researcher describe as leading to arbitrary code execution. The flaw matters because PDF readers are widely deployed and the trigger is a document users are accustomed to opening.

Impact

An attacker who gets the crafted file opened can execute arbitrary code in the context of the Foxit Reader process, giving full compromise of that user's session. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached by opening a malicious PDF, or by visiting a malicious site if the browser plugin extension is enabled. The vector is network-reachable with no privileges required, but user interaction (opening the file or visiting the page) is required.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high at 0.70388 (99.35th percentile), and both references are tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade Foxit PDF Reader beyond 10.1.0.37527 to a current supported release.
• Disable or remove the Foxit browser plugin extension so web pages cannot invoke the reader.
• Block or quarantine untrusted PDF attachments at the mail and web gateway.
• Where feasible, restrict PDF opening to a sandboxed or isolated viewer.
• Track Foxit advisories for the fixed build and verify the installed version across endpoints.

Detection

• Alert on Foxit Reader processes spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Monitor for Foxit Reader crashes or repeated restarts that may indicate memory corruption attempts.
• Hunt for PDFs delivered from external senders or newly registered domains that are opened shortly before suspicious process activity.
• Check endpoint telemetry for Foxit Reader loading unusual DLLs or writing executables to user-writable paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.