What is the CVSS score of CVE-2026-57243?

CVE-2026-57243 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.1%.

Foxit PDF Reader CVE-2026-57243

EUVD-2026-42208 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-08 Foxit

GHSA-9ppj-8p5h-jg89

Buffer Overflow Information Disclosure Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

6.1

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

vuln.today AI

6.1 MEDIUM

Local file open required (AV:L), no attacker privileges needed (PR:N), mandatory user interaction (UI:R), crash is reliable (A:H), OOB read yields minor memory leak (C:L), no write impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:29 vuln.today

DescriptionCVE.org

During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the application to crash.

AnalysisAI

Foxit PDF Reader and PDF Editor crash with potential memory disclosure when processing maliciously crafted PDF documents containing JavaScript that causes reentrancy during page opening or form formatting. The reentrancy leaves the document object in an inconsistent state; when the application subsequently attempts to dereference stale page metadata, it reads from an invalid memory address (CWE-125 out-of-bounds read), resulting in application termination and limited memory content exposure. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a local user interaction to open a crafted PDF file.

Technical ContextAI

The vulnerability arises in Foxit's PDF rendering and JavaScript execution engine during two specific operations: page opening and form formatting. JavaScript embedded in a PDF can trigger a reentrant call back into the same document-processing routine before the prior invocation has completed. This reentrancy leaves internal document state objects (page metadata, object references) in a partially updated or inconsistent condition. When the outer call resumes with now-stale pointers, it attempts to dereference an address that is no longer valid, constituting an out-of-bounds read (CWE-125). The immediate result is an application crash (availability: high), but because the invalid read occurs before the crash, a small amount of process memory may be transiently exposed (confidentiality: low). Affected products per CPE are cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*:*:*:*:*:*:*:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:*, spanning both the 13.x/14.x legacy branch and the 2026.x release branch.

RemediationAI

Consult the Foxit Security Bulletins page at https://www.foxit.com/support/security-bulletins.html to obtain the exact fixed release versions for your product branch (PDF Reader 2026.x, PDF Editor 2026.x, 14.x, or 13.x). Upgrade to the first version above the stated affected boundaries: for PDF Reader and PDF Editor 2026.x this means a version above 2026.1.1; for PDF Editor 14.x above 14.0.4; for PDF Editor 13.x above 13.2.4. Exact patched version numbers are not independently confirmed in the available data - verify against the vendor bulletin before communicating upgrade targets to users. As a compensating control where patching is delayed, configure endpoint security controls to restrict JavaScript execution in PDF documents - Foxit products support disabling JavaScript via Preferences > JavaScript, which would eliminate the reentrancy trigger at the cost of breaking interactive PDF forms. Additionally, consider blocking delivery of PDF files from untrusted external sources at email gateway and web proxy layers to reduce the social-engineering surface.