EUVD-2026-42179
GHSA-5744-9f6r-jfw3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malicious form JavaScript
-
DeliveryDeliver via email or web download
-
ExploitVictim opens PDF in Foxit
-
ExecutionScript modifies form, triggers page-state change
-
PersistEngine dereferences freed object (use-after-free)
-
ImpactCrash or arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted PDF in a vulnerable Foxit PDF Reader (≤2026.1.1) or Foxit PDF Editor (≤14.0.4 / ≤13.2.4 / ≤2026.1.1) - this is the UI:R user-interaction requirement and the AV:L local vector. The specific trigger is a PDF that uses embedded JavaScript to modify a form and then induces a page-state change, causing the engine to dereference invalidated page/form objects; JavaScript execution in the reader must be enabled (it is on by default), which is both the required feature and the primary limiting factor - disabling JavaScript Actions removes the trigger. No authentication is needed (PR:N), and no privileged access to the target host is required beyond the user opening the file. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High), driven by high impact across C/I/A but gated by a local attack vector (AV:L) and required user interaction (UI:R) - the victim must open a malicious PDF, which is the normal exploitation model for client-side document parsers. There is a notable tension in the source data: the description characterizes the outcome as a crash (denial of service), and the tags lead with 'Denial Of Service', yet the CVSS scores full C:H/I:H/A:H as if arbitrary code execution is achievable - verify the true impact ceiling with Foxit, as a pure DoS would warrant only A:H. No EPSS score, KEV entry, or POC was provided, so real-world exploitation pressure appears low today; use-after-free bugs in PDF readers are historically weaponizable but require heap-grooming effort. Net: a credible priority patch for endpoints where users routinely open untrusted PDFs, but not an emergency in the absence of any exploitation signal. |
| Exploit ScenarioDerived | An attacker emails or hosts a crafted PDF containing JavaScript that modifies an AcroForm and then triggers a page-state change; when the victim opens it in a vulnerable Foxit PDF Reader or Editor, the application dereferences a freed object, crashing the process and potentially executing attacker-controlled code if the heap is groomed. Because the attack vector is local with required user interaction, exploitation hinges on social engineering to get the target to open the document. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Use-after-free memory corruption in Foxit PDF Reader (2026.1.1 and earlier) and Foxit PDF Editor (through 14.0.4, 13.2.4, and 2026.1.1) allows a remote attacker to execute arbitrary code or crash the application when a victim opens a maliciously crafted PDF. The flaw stems from JavaScript-driven form modifications that leave page-related objects with incomplete lifecycle management, so the application dereferences freed/invalid objects on page-state changes. No public exploit identified at time of analysis, and it is not listed in CISA KEV; while the description emphasizes a crash, the CVSS vector rates full confidentiality, integrity, and availability impact, consistent with exploitable memory corruption.
RemediationAI
Upgrade to the fixed Foxit builds published in the vendor's security bulletin at https://www.foxit.com/support/security-bulletins.html; the input data does not specify an exact patched version, so treat this as 'Patch available per vendor advisory' and verify the target build against that bulletin before deployment (do not deploy an unverified version number). As an interim compensating control, disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which directly removes the JavaScript-driven form-modification trigger at the cost of breaking legitimate interactive forms and calculated fields; additionally, enable/keep Foxit's Safe Reading Mode and restrict opening of PDFs from untrusted sources via email/download gateways. Where feasible, route untrusted PDFs through a sandboxed viewer or CDR (content disarm and reconstruction) pipeline until patched.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Foxit's PDF rendering and interactive-forms (AcroForm) engine, where embedded JavaScript can programmatically modify form fields at runtime. Per CWE-416 (Use After Free), the affected page and form objects lack complete lifecycle management and null-value validation: when a JavaScript action alters the form and the page state subsequently changes, the engine continues to dereference objects that have already been freed or invalidated. The CPE data confirms two affected applications - cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor - both of which share the same core rendering/JavaScript stack, meaning the defect is in shared parsing/scripting code rather than a single product. Use-after-free conditions like this are a classic bridge from a crash (dangling pointer read) to code execution when an attacker can groom the heap to control the contents of the freed allocation.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L) with required user interaction (UI:R), no auth (PR:N); memory corruption plausibly yields code execution, so C/I/A:H, though a pure DoS would drop C/I to N.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Reader and Editor contain a use-after-free vulnerability (CVE-2026-57242) enabling remote code execution when users open maliciously crafted PDFs. Although no public exploit has been identified at time of analysis, the lack of available vendor patch creates immediate operational risk to any organization where employees handle PDF documents from external or untrusted sources.
Disable JavaScript execution in Foxit Reader and Editor; restrict PDF access to internally-sourced documents only; implement email gateway and web filtering for PDF attachments from external senders; deploy EDR monitoring with alerts for Foxit memory corruption indicators and unusual child process spawning; stage transition to alternative PDF readers pending vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB