What is the CVSS score of CVE-2026-57237?

CVE-2026-57237 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Editor are affected by CVE-2026-57237?

Foxit PDF Editor and Reader versions up to 14.0.4, 13.2.4, and 2026.1.1 contain a memory corruption vulnerability (CVE-2026-57237) that could allow attackers to crash applications or execute…

How to fix or mitigate CVE-2026-57237?

Within 24 hours: Identify all systems running Foxit PDF Editor versions 14.0.4, 13.2.4, or 2026.1.1, and Foxit PDF Reader version 2026.1.1 or earlier, prioritizing finance, legal, and executive-facing systems. Within 7 days: Disable JavaScript execution within Foxit client settings, restrict PDF file access from untrusted external sources, and implement behavioral monitoring for suspicious Foxit process activity. Within 30 days: Establish vendor contact for patch timeline, prepare patch deployment procedures, and evaluate alternative PDF readers for high-risk workflows.

Foxit PDF Editor CVE-2026-57237

EUVD-2026-42196 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-f45g-jmhf-r684

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local client-side flaw triggered by opening a crafted PDF, so AV:L and UI:R with no privileges; use-after-free plausibly yields code execution, so C/I/A:H consistent with vendor scoring.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:14 vuln.today

DescriptionCVE.org

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) allows an attacker to corrupt object state and read an illegal memory address when a victim opens a crafted PDF that manipulates form-field properties via embedded JavaScript. The immediate observed impact is an application crash (denial of service), but the CWE-416 root cause and the vendor's CVSS confidentiality/integrity ratings indicate potential for arbitrary code execution in the context of the user. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected technology is Foxit's PDF rendering engine and its embedded JavaScript interpreter, which exposes an Acroform/form-field object model to document-supplied scripts. Per CWE-416 (Use After Free), when the JavaScript engine modifies properties of form-field objects, the underlying native objects the interpreter references are freed or invalidated while a dangling reference is retained; a subsequent access dereferences that stale pointer, reading an illegal memory address. The CPE data scopes the exposure to cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader (desktop applications). Use-after-free conditions in document parsers are a classic memory-corruption primitive: depending on heap layout and whether the freed slot can be reallocated with attacker-controlled data, the outcome ranges from a reliable crash to controlled-pointer exploitation.

RemediationAI

Upgrade to the latest fixed release of Foxit PDF Editor and Foxit PDF Reader as published on the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html); the input provides no exact patched version number, so Patch available per vendor advisory - confirm the specific fixed build directly from that bulletin before deployment. As a compensating control until patched, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which neutralizes this specific form-field script trigger at the cost of breaking legitimate interactive/form-based PDFs; additionally, open untrusted PDFs in Safe Reading Mode and enforce opening documents from unknown sources only in a sandboxed or isolated environment. Avoid opening PDFs from untrusted email or web sources until the upgrade is applied.