What is the CVSS score of CVE-2026-57247?

CVE-2026-57247 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Editor are affected by CVE-2026-57247?

Foxit PDF Editor and Reader (through versions 14.0.4/2026.1.1 and 2026.1.1 respectively) contain a use-after-free vulnerability that crashes the application when users open malicious PDFs, creating a…

How to fix or mitigate CVE-2026-57247?

Within 24 hours: Inventory all Foxit PDF Editor (through 14.0.4/2026.1.1) and Foxit PDF Reader (through 2026.1.1) installations across the organization and document business-critical workflows depending on these products. Within 7 days: Deploy user awareness training on PDF-based threats, establish policy restricting opening of unsolicited/unverified PDFs from external sources, and restrict application execution where feasible. Within 30 days: Monitor Foxit security advisories for patch availability, establish testing and deployment plan for when patch releases, and evaluate alternative PDF readers with active patch programs.

Foxit PDF Editor CVE-2026-57247

EUVD-2026-42194 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-v6wf-mgv3-6mx5

Memory Corruption Denial Of Service Use After Free Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Local malicious-file vector needing user to open the PDF (AV:L/UI:R, PR:N); described outcome is an illegal read and crash so A:H with only possible limited memory disclosure (C:L) and no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:03 vuln.today

DescriptionCVE.org

The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objects obtained before deletion, triggering an illegal read and crashing.

AnalysisAI

Use-after-free during PDF field processing in Foxit PDF Editor and Foxit PDF Reader allows a crafted document to delete the current page and then reuse now-dangling field objects, causing an illegal memory read and application crash. Affects Foxit PDF Editor through 14.0.4 / 2026.1.1 and Foxit PDF Reader through 2026.1.1; exploitation requires a user to open a malicious PDF. No public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor (Foxit) reported it and tags it primarily as denial of service / memory corruption.

Technical ContextAI

The root cause is CWE-416 (Use After Free). During interactive form/field processing the application re-enters the document object structure and deletes the current page object; execution then continues to operate on field objects that were captured before the deletion, so those pointers now reference freed memory. Dereferencing them produces an out-of-bounds/illegal read. The affected components are the desktop PDF engines identified by the CPEs cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader - client-side document parsers/renderers that process untrusted PDF content, a class of software where lifetime-management bugs in form and annotation handling are a recurring source of memory-corruption vulnerabilities.

RemediationAI

Patch available per vendor advisory: update to the latest fixed release of Foxit PDF Editor and Foxit PDF Reader listed on the Foxit security bulletins page at https://www.foxit.com/support/security-bulletins.html (the input does not specify an exact patched version number, so confirm the fixed build there before deploying). Because the affected versions are all builds 'and earlier', upgrade past the highest listed vulnerable versions (Editor 14.0.4 / 13.2.4 / 2026.1.1 and Reader 2026.1.1). Until patched, compensating controls include disabling or restricting interactive PDF form/JavaScript features in the product's preferences to reduce field-processing exposure (trade-off: breaks legitimate form workflows), enabling Safe Reading/Protected Mode if available, and instructing users not to open PDFs from untrusted sources; organizations can also route PDFs through a server-side sandbox or alternate renderer for untrusted mail attachments (trade-off: added processing latency and possible rendering fidelity differences).