What is the CVSS score of CVE-2026-57244?

CVE-2026-57244 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Editor are affected by CVE-2026-57244?

Foxit PDF Editor and Reader (versions through 14.0.4 and 2026.1.1 respectively) contain a use-after-free vulnerability allowing code execution when users open malicious PDF documents.

How to fix or mitigate CVE-2026-57244?

Within 24 hours: Audit enterprise Foxit installations (PDF Editor ≤14.0.4, PDF Reader ≤2026.1.1) and communicate vulnerability advisory to users; disable JavaScript execution in Foxit settings. Within 7 days: Deploy mail gateway and web controls to block PDF delivery from untrusted external sources; configure EDR/antivirus alerts for Foxit application crashes and anomalous process behavior. Within 30 days: Apply Foxit vendor-released patch immediately upon availability; evaluate alternative PDF solutions (Adobe Reader DC, browser-based viewers) for future enterprise deployment.

Foxit PDF Editor CVE-2026-57244

EUVD-2026-42195 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-x84g-p925-fhwq

Memory Corruption Denial Of Service Use After Free Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local crafted-file vector needing the user to open a PDF (AV:L/UI:R), no privileges (PR:N); UAF memory corruption justifies high C/I/A per vendor, though DoS-only impact is plausible.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:07 vuln.today

DescriptionCVE.org

After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in the failure of the control pointer during the traversal process. After the pointer fails, it still continues to dereference, causing the application to crash.

AnalysisAI

Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Foxit, the reporting vendor, has issued a security bulletin covering the affected versions.

Technical ContextAI

The flaw is a CWE-416 use-after-free in the JavaScript-driven form handling engine of Foxit's PDF rendering stack, shared across both the Editor and Reader products (per CPE cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader). PDF documents can embed JavaScript that manipulates AcroForm fields; when a script resets the form, the internal synchronization/traversal routine lacks re-entry protection and object lifecycle verification, so an object referenced by a control pointer can be freed while a traversal is still in progress. The code then continues to dereference the now-dangling pointer. Use-after-free conditions are a classic memory-corruption primitive: at minimum they cause deterministic crashes (denial of service), and depending on heap grooming they can escalate to controlled writes and code execution, which is consistent with the vendor's high confidentiality/integrity/availability rating.

RemediationAI

Patch available per vendor advisory: upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed release listed on Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html (a specific fixed version number was not included in the provided data and should be taken directly from that bulletin - do not assume a version). Because exploitation depends on embedded form-reset JavaScript, an effective compensating control while patching is to disable JavaScript execution in Foxit (Preferences → JavaScript → uncheck 'Enable JavaScript Actions'), which neutralizes this specific vector at the cost of breaking legitimate interactive/AcroForm and dynamic PDF workflows. Additionally, enable Foxit's Safe Reading Mode / sandbox protections and block or quarantine PDFs from untrusted external sources at the email and web gateway. Avoid opening PDFs from unknown senders until the update is deployed.