Foxit PDF Reader CVE-2026-57243

The victim must actively open a crafted PDF file in an affected version of Foxit PDF Reader or Foxit PDF Editor (UI:R is mandatory - passive network exposure alone cannot trigger this). The PDF must contain embedded JavaScript capable of inducing reentrancy specifically during page-open or form-formatting processing; documents without JavaScript or without these processing triggers are not affected. No attacker-side authentication or system privileges are required (PR:N). The attack is local-file-origin (AV:L): the PDF must be present on the victim's filesystem or opened directly from a browser download - a purely network-resident document not yet opened does not expose the vulnerability. Limiting factors: mandatory user interaction to open the file, requirement for JavaScript to be enabled in Foxit (the default), and restriction to specific processing phases (page open, form format) meaning not all PDF-with-JavaScript files will trigger the flaw.

The CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H accurately captures the realistic threat posture. The local attack vector (AV:L) means exploitation cannot be triggered remotely without the user first obtaining and opening a crafted file - this significantly limits opportunistic exploitation. UI:R confirms mandatory user interaction, adding a meaningful social-engineering barrier. The high availability impact (A:H) reflects reliable application crash, while confidentiality impact is limited (C:L), with no integrity impact. No EPSS data was provided in the input; without it, statistical exploitation probability cannot be cited. There is no CISA KEV listing and no public POC identified, keeping this firmly in the 'watch and patch' rather than 'emergency response' category. The discrepancy between the 'Buffer Overflow' tag and the CWE-125 (Out-of-Bounds Read) root cause classification is worth noting: the crash behavior could stem from a read of attacker-influenced data rather than a write overrun, so the 'buffer overflow' tag may be imprecise vendor labeling rather than a confirmed write primitive. Security teams should treat this as a denial-of-service risk with a minor information-disclosure dimension, not a code-execution issue, unless further analysis reveals a write path.

An attacker crafts a PDF document embedding JavaScript designed to invoke a page-open or form-formatting routine in a reentrant manner - for example, triggering a second document event while the first is still resolving. The attacker then distributes the file via email phishing or a malicious download link, inducing the victim to open it in Foxit PDF Reader or Editor. Upon opening, the reentrancy corrupts internal document state, the application reads from an invalid memory address, and crashes - potentially leaking a small amount of process memory contents to an attacker who can observe the crash dump or otherwise influence the read target.