EUVD-2026-42196
GHSA-f45g-jmhf-r684
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF with form-field JavaScript
-
DeliveryDeliver via phishing or web link
-
ExploitVictim opens PDF in Foxit
-
ExecutionScript invalidates form-field object state
-
PersistDangling pointer dereferenced (use-after-free)
-
ImpactCrash or code execution in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted PDF in a vulnerable Foxit PDF Editor or Reader build AND requires Foxit's embedded JavaScript execution to be enabled (the default), because the trigger is JavaScript that modifies form-field properties. The limiting factors are mandatory user interaction (UI:R - the user must open the malicious document) and the local attack vector (AV:L - no remote/network-triggered path); no authentication is needed (PR:N). Disabling JavaScript actions in Foxit's preferences removes the required condition and blocks this specific attack path. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8, High) describes a local, low-complexity, unauthenticated flaw requiring user interaction - consistent with the client-side 'open a malicious PDF' delivery model rather than remote network exploitation. The high C/I/A impact ratings imply the vendor considers code execution feasible, yet the plain-language description explicitly states only that the application crashes, so there is a notable tension: the description reads as a denial-of-service while the scored impact reads as full compromise - defenders should treat RCE as plausible but not independently confirmed. No EPSS score, KEV entry, or SSVC decision data was provided, and no public POC is referenced, so exploitation probability cannot be quantified from the input. Net assessment: a credible client-side memory-corruption bug in widely deployed PDF software that merits timely patching, but with no evidence of active or automated exploitation at this time. |
| Exploit ScenarioDerived | An attacker crafts a PDF containing JavaScript that alters form-field properties to trigger the use-after-free, then delivers it via phishing email or a malicious website link. When the victim opens the document in a vulnerable Foxit PDF Editor or Reader build, the dangling reference is dereferenced, crashing the application and - given the CWE-416 class and high impact rating - potentially executing attacker code in the user's context. No public exploit code is currently identified, and successful exploitation depends on the low-complexity local vector requiring the user to open the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) allows an attacker to corrupt object state and read an illegal memory address when a victim opens a crafted PDF that manipulates form-field properties via embedded JavaScript. The immediate observed impact is an application crash (denial of service), but the CWE-416 root cause and the vendor's CVSS confidentiality/integrity ratings indicate potential for arbitrary code execution in the context of the user. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
RemediationAI
Upgrade to the latest fixed release of Foxit PDF Editor and Foxit PDF Reader as published on the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html); the input provides no exact patched version number, so Patch available per vendor advisory - confirm the specific fixed build directly from that bulletin before deployment. As a compensating control until patched, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which neutralizes this specific form-field script trigger at the cost of breaking legitimate interactive/form-based PDFs; additionally, open untrusted PDFs in Safe Reading Mode and enforce opening documents from unknown sources only in a sandboxed or isolated environment. Avoid opening PDFs from untrusted email or web sources until the upgrade is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Foxit's PDF rendering engine and its embedded JavaScript interpreter, which exposes an Acroform/form-field object model to document-supplied scripts. Per CWE-416 (Use After Free), when the JavaScript engine modifies properties of form-field objects, the underlying native objects the interpreter references are freed or invalidated while a dangling reference is retained; a subsequent access dereferences that stale pointer, reading an illegal memory address. The CPE data scopes the exposure to cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader (desktop applications). Use-after-free conditions in document parsers are a classic memory-corruption primitive: depending on heap layout and whether the freed slot can be reallocated with attacker-controlled data, the outcome ranges from a reliable crash to controlled-pointer exploitation.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local client-side flaw triggered by opening a crafted PDF, so AV:L and UI:R with no privileges; use-after-free plausibly yields code execution, so C/I/A:H consistent with vendor scoring.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and Reader versions up to 14.0.4, 13.2.4, and 2026.1.1 contain a memory corruption vulnerability (CVE-2026-57237) that could allow attackers to crash applications or execute arbitrary code when users open malicious PDF documents. This affects millions of users across enterprises relying on Foxit for document handling, creating potential risk to data confidentiality and system availability. With no vendor-released patch identified at time of analysis, immediate interim security controls are required to prevent exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable embedded JavaScript execution in Foxit settings and enforce via Group Policy where applicable; (2) Restrict PDF file access from email and internet downloads, routing suspicious files through secure or sandboxed analysis; (3) Implement endpoint detection and response (EDR) or process monitoring to alert on Foxit crashes or abnormal memory access patterns; (4) Consider temporary restriction of Foxit usage to vetted, pre-validated PDF documents only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB