What is the CVSS score of CVE-2026-57245?

CVE-2026-57245 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-57245?

Foxit PDF Reader and Foxit PDF Editor contain an unpatched memory corruption vulnerability (CVE-2026-57245) capable of enabling code execution when employees open maliciously crafted PDF files.

How to fix or mitigate CVE-2026-57245?

24 hours: Inventory all systems running Foxit PDF Reader (≤2026.1.1) and Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1); disable PDF hyperlink functionality in product settings if operationally feasible. 7 days: Deploy compensating controls-sandbox Foxit instances using virtualization or container isolation, restrict PDF processing to internal trusted sources only, and configure email gateway to filter external PDF attachments. 30 days: Subscribe to Foxit security advisories; establish patch testing and staged rollout plan for deployment when vendor releases fix.

Foxit PDF Reader CVE-2026-57245

EUVD-2026-42207 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-6g2w-33jp-v2w5

Memory Corruption Denial Of Service Use After Free Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-parsing UAF needs a locally opened malicious PDF (AV:L, UI:R) with no privileges (PR:N); memory-write primitive supports high C/I/A despite only a crash being demonstrated.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:06 vuln.today

DescriptionCVE.org

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.

AnalysisAI

Memory corruption in Foxit PDF Reader (≤2026.1.1) and Foxit PDF Editor (≤14.0.4, ≤13.2.4, and ≤2026.1.1) allows an attacker to trigger a use-after-free when a victim opens a maliciously crafted PDF whose hyperlink annotation objects use abnormal relationships and field combinations. The flaw manifests as an invalid pointer write during object destruction; while the vendor description only confirms an application crash, the vendor-assigned CVSS (C:H/I:H/A:H) and CWE-416 classification indicate potential for arbitrary code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The defect is a CWE-416 use-after-free in the PDF annotation-parsing subsystem shared by Foxit's PDF Reader and Editor engines (cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor). PDF annotations are dictionary objects linked to page and field structures; link (hyperlink) annotations reference action and destination objects. Foxit's parser builds these annotation elements without validating that the annotation relationships and field combinations are well-formed, so a crafted PDF drives the internal object graph into an invalid state. When the document is later torn down, a dangling/invalid pointer is dereferenced for a write during destruction - the classic use-after-free primitive that can corrupt heap memory and, in the worst case, be shaped into control-flow hijacking rather than a mere crash.

RemediationAI

Upgrade to a Foxit-supplied fixed release above the affected ranges (Reader beyond 2026.1.1; Editor beyond 14.0.4 / 13.2.4 / 2026.1.1); Patch available per vendor advisory at https://www.foxit.com/support/security-bulletins.html - the exact patched version number is not stated in the provided data and must be confirmed from that bulletin. Until patched, compensating controls include disabling automatic PDF preview/rendering in mail clients and browsers so files are not opened silently, and instructing users not to open PDFs from untrusted senders (trade-off: relies on user behavior and does not stop a determined phishing lure). Where feasible, route inbound PDFs through a sandboxed viewer or content-disarm-and-reconstruction gateway, and consider opening untrusted PDFs in an alternate/hardened viewer or isolated VM (trade-off: workflow friction and possible rendering-fidelity loss). Application-level exploit mitigations such as enforced DEP/ASLR and least-privilege execution reduce the odds that the invalid-pointer write escalates beyond a crash.