What is the CVSS score of CVE-2026-57241?

CVE-2026-57241 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.1%.

Foxit PDF Editor CVE-2026-57241

EUVD-2026-42180 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-08 Foxit

GHSA-r64f-c494-296f

Buffer Overflow Information Disclosure Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

6.1

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

vuln.today AI

6.1 MEDIUM

User must open a local file (AV:L, UI:R); default JavaScript-enabled config requires no special privileges (PR:N); crash is primary impact (A:H) with minor memory exposure (C:L), no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:30 vuln.today

DescriptionCVE.org

The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.

AnalysisAI

Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader allows a local attacker to crash the application and potentially expose adjacent memory contents by delivering a specially crafted PDF containing malicious JavaScript. The JavaScript manipulates page and document objects to desynchronize internal page-related state from the renderer's trusted page count; when the renderer subsequently accesses page objects using the stale index, it reads beyond valid memory bounds. No public exploit identified at time of analysis and no CISA KEV listing, but the broad affected version ranges across multiple major release branches (13.x, 14.x, and 2026.x) means a large proportion of unpatched Foxit deployments are exposed.

Technical ContextAI

The vulnerability is rooted in CWE-125 (Out-of-bounds Read) within Foxit's embedded PDF JavaScript engine. PDF documents can contain JavaScript that programmatically operates on page and document objects at runtime. In this case, JavaScript-driven operations cause internal page-related objects to fall out of sync with the page count value the renderer has cached or trusted. When the renderer subsequently indexes into a page object array using the now-stale count, it accesses memory outside the valid allocation - a classic out-of-bounds read. This results in a crash (high availability impact) and may expose a small amount of adjacent memory (low confidentiality impact per CVSS C:L). The affected CPEs are cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*:*:*:*:*:*:*:*, spanning the full version wildcards for both products across the 13.x, 14.x, and 2026.x branches.

RemediationAI

Users and administrators should consult the Foxit security bulletins at https://www.foxit.com/support/security-bulletins.html and upgrade to patched versions beyond the affected thresholds: Foxit PDF Editor above 14.0.4, above 13.2.4, or above 2026.1.1 depending on the installed branch, and Foxit PDF Reader above 2026.1.1. Exact patched version numbers have not been independently confirmed beyond the stated affected-version ceilings from the EUVD advisory. As a compensating control, disable JavaScript execution in Foxit applications via Preferences > JavaScript > uncheck 'Enable JavaScript' - note this will break interactive PDF forms and JavaScript-dependent document features, which is a meaningful trade-off in enterprise environments where Foxit is used for form processing. Additionally, configuring email gateway or endpoint controls to scan PDFs for embedded JavaScript before delivery to end users reduces the attack surface for phishing-based delivery.