What is the CVSS score of CVE-2026-57240?

CVE-2026-57240 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-57240?

A memory corruption vulnerability in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (14.0.4 and earlier) allows arbitrary code execution when users open malicious PDF files containing…

How to fix or mitigate CVE-2026-57240?

Within 24 hours: Issue mandatory security alert identifying affected Foxit versions in your environment; restrict opening PDFs from external/untrusted sources to high-trust users only; disable JavaScript in Foxit Reader settings organization-wide. Within 7 days: Deploy email gateway rules to quarantine or block PDFs from external domains; enable file sandboxing for PDF analysis where possible; configure endpoint monitoring for memory corruption exploit patterns. Within 30 days: Establish vendor escalation with Foxit for patch timeline and interim workarounds; evaluate alternative PDF readers (e.g., Adobe Reader, SumatraPDF) with comparable security profiles; conduct targeted user awareness training on PDF-based attacks.

Foxit PDF Reader CVE-2026-57240

EUVD-2026-42183 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-mvfx-5v77-ghpf

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open with required user interaction (AV:L/UI:R); no auth needed (PR:N); use-after-free plausibly enables code execution so C/I/A:H retained, though described impact is only a crash.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:10 vuln.today

DescriptionCVE.org

When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid pointer references and causing the application to crash.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Reader and Foxit PDF Editor lets a crafted PDF containing JavaScript trigger stale field-pointer dereferences after the script deletes form fields, corrupting memory and crashing the application. The flaw affects Foxit PDF Editor 14.0.4 and earlier and Foxit PDF Reader 2026.1.1 and earlier and requires the victim to open a malicious file. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Foxit's own CVSS of 7.8 (C:H/I:H/A:H) implies potential code execution beyond the crash described.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in the AcroForm/JavaScript engine shared by Foxit's PDF products. PDF documents can embed JavaScript that manipulates interactive form fields at runtime; when the script deletes field objects, the application frees the underlying field objects but retains and reuses the now-dangling field pointers in subsequent processing logic. Dereferencing these freed pointers reads or writes reclaimed heap memory, producing memory corruption. Per the CPE data, the affected code is in cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader, indicating the shared rendering/scripting core rather than an OS component.

RemediationAI

Patch available per vendor advisory - Foxit reported this issue and publishes fixes on its security bulletins page at https://www.foxit.com/support/security-bulletins.html; upgrade Foxit PDF Editor beyond 14.0.4 (and beyond the 13.2.4 and 2026.1.1 branches) and Foxit PDF Reader beyond 2026.1.1 to the versions Foxit lists as fixed, as no exact patched version number was provided in this input and should be confirmed against the bulletin. As a compensating control until patching, disable JavaScript execution in Foxit (Preferences > JavaScript > uncheck 'Enable JavaScript Actions'), which removes the trigger path for this field-deletion bug at the cost of breaking legitimate form scripts and dynamic form behavior; additionally, restrict opening of untrusted PDFs and enable Foxit's Safe Reading Mode / protected view to reduce exposure to malicious documents.