Foxit PDF Reader CVE-2026-57245

Exploitation requires the victim to open an attacker-crafted PDF in Foxit PDF Reader or Foxit PDF Editor (CVSS UI:R - mandatory user interaction; AV:L - the file must be delivered to and opened on the target host). The specific trigger is a PDF containing hyperlink (link) annotations with abnormal annotation relationships and invalid field combinations that the parser fails to validate; a normal, well-formed PDF will not trigger the bug. No authentication is needed (PR:N), and no non-default configuration is required - default annotation/hyperlink handling is affected. Limiting factors: the attack cannot fire without user action to open the document, it runs only in the user's own privilege context (S:U), and the guaranteed outcome is a crash while code execution is an unproven worst case.

The vendor CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High) and is internally consistent for a file-parsing bug: local attack vector (the malicious file must reach the machine), no privileges, but mandatory user interaction (the victim must open the PDF). The full C:H/I:H/A:H impact reflects UAF's code-execution potential, yet the written description only demonstrates a crash - note this tension: the confirmed observable behavior is denial of service (see Tags: Denial Of Service, Use After Free, Memory Corruption), while high confidentiality/integrity impact is an inferred worst case, not a demonstrated one. No EPSS score, SSVC decision, or KEV entry was provided, so real-world exploitation probability cannot be quantified from the input; absence of a POC and KEV listing suggests this is currently a defense-in-depth patch priority rather than an under-active-attack emergency. Because exploitation depends on social engineering a user into opening a file, mass automated exploitation is unlikely, but targeted phishing against high-value users is realistic.

An attacker emails or hosts a booby-trapped PDF whose hyperlink annotations carry malformed relationships and field combinations, then lures a victim into opening it in Foxit PDF Reader or Editor. Parsing drives the annotation objects into an invalid state, and on document close the use-after-free write corrupts memory, crashing the application and - if the heap is groomed - potentially executing attacker-controlled code in the user's context. No public POC was identified in the provided data, and the AV:L/AC:L/UI:R profile means the only real barrier is convincing the user to open the file.