Foxit PDF Editor CVE-2026-57241

JavaScript must be enabled in the Foxit PDF application, which is the default configuration. The victim must actively open a specially crafted PDF file - confirmed by UI:R in the CVSS vector. No authentication or elevated privileges are required (PR:N in the CVSS vector), meaning any standard user account can be targeted. The attack is local in the CVSS sense (AV:L): the malicious file must be opened on the victim's machine rather than exploited over a network socket directly. Limiting factors include: the victim must be induced to open the document (social engineering or phishing required), JavaScript must not have been manually disabled in application preferences, and the impact is limited to crash and minor memory disclosure - no code execution is indicated by the available data.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H accurately captures the threat profile: this is a local, user-interaction-dependent attack with no authentication requirement. The primary real-world risk is application crash (denial of service), with a secondary but limited risk of memory disclosure. No EPSS data was provided in the input, no KEV listing exists, and no POC has been identified - all of which lower urgency relative to the raw CVSS score. However, the attack delivery mechanism (a malicious PDF opened by a user) is highly realistic given PDF files are a common phishing vector. The wide scope of affected versions - spanning PDF Editor 13.2.4 and earlier, 14.0.4 and earlier, 2026.1.1 and earlier, and PDF Reader 2026.1.1 and earlier - means the exposed population is large. The absence of remote code execution and the crash-only primary impact make this a medium-priority patch rather than an emergency response item, but organizations where Foxit PDF tools process untrusted documents should treat this as a meaningful risk.

An attacker crafts a PDF document containing JavaScript that programmatically manipulates page-level objects to desynchronize the renderer's internal page count state. The PDF is delivered to a target via email attachment or malicious download link. When the victim opens the file in an unpatched version of Foxit PDF Editor or Reader, the JavaScript executes, the page object synchronization is broken, the renderer accesses out-of-bounds memory, and the application crashes - potentially leaking a small amount of process memory. No public exploit identified at time of analysis.