What is the CVSS score of CVE-2026-57242?

CVE-2026-57242 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-57242?

Foxit PDF Reader and Editor contain a use-after-free vulnerability (CVE-2026-57242) enabling remote code execution when users open maliciously crafted PDFs.

How to fix or mitigate CVE-2026-57242?

Within 24 hours: Inventory all systems running Foxit PDF Reader (2026.1.1 and earlier) or Foxit PDF Editor (through 14.0.4, 13.2.4, 2026.1.1); restrict PDF opening to trusted sources and disable JavaScript execution in Foxit application settings. Within 7 days: Enforce application usage policies limiting PDF handling to essential business functions; deploy endpoint detection and response (EDR) monitoring for abnormal Foxit process behavior. Within 30 days: Monitor Foxit vendor advisory pages daily for patch announcement; develop and test update deployment procedure; transition affected users to alternative PDF readers (Adobe Reader, Sumatra PDF) as interim measure.

Foxit PDF Reader CVE-2026-57242

EUVD-2026-42179 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-5744-9f6r-jfw3

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector (AV:L) with required user interaction (UI:R), no auth (PR:N); memory corruption plausibly yields code execution, so C/I/A:H, though a pure DoS would drop C/I to N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:08 vuln.today

DescriptionCVE.org

The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (through 14.0.4, 13.2.4, and 2026.1.1) allows a remote attacker to execute arbitrary code or crash the application when a victim opens a maliciously crafted PDF. The flaw stems from JavaScript-driven form modifications that leave page-related objects with incomplete lifecycle management, so the application dereferences freed/invalid objects on page-state changes. No public exploit identified at time of analysis, and it is not listed in CISA KEV; while the description emphasizes a crash, the CVSS vector rates full confidentiality, integrity, and availability impact, consistent with exploitable memory corruption.

Technical ContextAI

The vulnerability lives in Foxit's PDF rendering and interactive-forms (AcroForm) engine, where embedded JavaScript can programmatically modify form fields at runtime. Per CWE-416 (Use After Free), the affected page and form objects lack complete lifecycle management and null-value validation: when a JavaScript action alters the form and the page state subsequently changes, the engine continues to dereference objects that have already been freed or invalidated. The CPE data confirms two affected applications - cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor - both of which share the same core rendering/JavaScript stack, meaning the defect is in shared parsing/scripting code rather than a single product. Use-after-free conditions like this are a classic bridge from a crash (dangling pointer read) to code execution when an attacker can groom the heap to control the contents of the freed allocation.

RemediationAI

Upgrade to the fixed Foxit builds published in the vendor's security bulletin at https://www.foxit.com/support/security-bulletins.html; the input data does not specify an exact patched version, so treat this as 'Patch available per vendor advisory' and verify the target build against that bulletin before deployment (do not deploy an unverified version number). As an interim compensating control, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly removes the JavaScript-driven form-modification trigger at the cost of breaking legitimate interactive forms and calculated fields; additionally, enable/keep Foxit's Safe Reading Mode and restrict opening of PDFs from untrusted sources via email/download gateways. Where feasible, route untrusted PDFs through a sandboxed viewer or CDR (content disarm and reconstruction) pipeline until patched.