What is the CVSS score of CVE-2026-57238?

CVE-2026-57238 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-57238?

Foxit PDF Reader and PDF Editor (versions through 2026.1.1) contain a memory corruption vulnerability that could allow attackers to compromise systems via malicious PDF files.

How to fix or mitigate CVE-2026-57238?

Within 24 hours: Inventory all Foxit Reader and Editor installations (versions 2026.1.1, 14.0.4, 13.2.4 and earlier) and identify exposure to external PDF sources. Within 7 days: Disable JavaScript in Foxit settings (Security > Preferences > JavaScript), implement email and download controls to restrict suspicious PDFs, and issue security awareness guidance to users. Within 30 days: Monitor Foxit security advisories for patch releases; deploy vendor patches immediately upon availability to all affected versions; evaluate transitioning high-risk PDF processing to alternative readers or sandboxed environments.

Foxit PDF Reader CVE-2026-57238

EUVD-2026-42181 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-hcmc-qwvc-894j

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector with required user interaction and no privileges; A:H is certain (crash), and C:H/I:H reflect the use-after-free's plausible escalation to code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:13 vuln.today

DescriptionCVE.org

After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.

AnalysisAI

Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF to trigger a use-after-free through the embedded JavaScript engine, where a form field object is deleted and then re-accessed, crashing the application. The flaw affects PDF Editor through 13.2.4, 14.0.4, and 2026.1.1, and PDF Reader through 2026.1.1, and was reported by Foxit. No public exploit has been identified at time of analysis, though CVSS scores the impact as high across confidentiality, integrity, and availability, implying potential exploitation beyond a simple crash.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in the client-side JavaScript interpreter that Foxit PDF Reader/Editor embeds to support interactive PDF features such as AcroForm form fields. When script deletes a form field object, the underlying native memory is freed, but a subsequent script operation dereferences the now-dangling reference to that object. Because form-field manipulation via JavaScript is a core, always-available capability of these viewers, the dangling pointer is reachable from any opened document. CPE data identifies the exact affected code as cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader. Use-after-free conditions of this class frequently allow controlled reuse of the freed allocation, which is why they are often escalatable from a crash to code execution.

RemediationAI

Upgrade to the latest fixed release of Foxit PDF Editor and Foxit PDF Reader as published on the Foxit security bulletins page (https://www.foxit.com/support/security-bulletins.html); the affected trains are Editor 13.2.4/14.0.4/2026.1.1 and earlier and Reader 2026.1.1 and earlier, so move to the vendor's next patched build above these - a specific fixed version was not included in the provided data and should be confirmed against the bulletin. As a compensating control until patched, disable JavaScript execution in the reader (Preferences > JavaScript > uncheck 'Enable JavaScript Actions'), which directly removes the attack surface for this form-field use-after-free at the cost of breaking legitimate interactive/AcroForm PDFs; additionally, avoid opening untrusted PDFs and enable Safe Reading Mode to restrict scripted actions. Patch status: no vendor-released fixed version was independently confirmed from the supplied references - patch available per vendor advisory.