What is the CVSS score of CVE-2026-57248?

CVE-2026-57248 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Reader are affected by CVE-2026-57248?

Foxit PDF Reader and Foxit PDF Editor contain a memory-corruption vulnerability enabling denial of service or code execution when users open a crafted PDF file.

How to fix or mitigate CVE-2026-57248?

Within 24 hours: Disable PDF JavaScript in Foxit Reader and Editor (Settings > JavaScript) to eliminate the attack vector and notify all users of this mandatory configuration change. Within 7 days: Implement security policy restricting opening of PDFs from untrusted sources and deploy technical controls (email gateway filtering, content restriction policies) to prevent delivery. Within 30 days: Evaluate alternative PDF readers for sensitive workflows, deploy sandboxing solutions for high-risk document handling, and establish daily monitoring of Foxit security advisories for patch release.

Foxit PDF Reader CVE-2026-57248

EUVD-2026-42205 HIGH

Release of Invalid Pointer or Reference (CWE-763)

2026-07-08 Foxit

GHSA-5mvj-c93h-4pfc

Denial Of Service Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Local crafted file with required user interaction (AV:L/UI:R); vendor describes a crash so availability is High, but confidentiality/integrity lowered to Low absent proven code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:01 vuln.today

DescriptionCVE.org

When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the application to crash during subsequent release.

AnalysisAI

Memory-corruption crash (and potential code execution) in Foxit PDF Reader and Foxit PDF Editor occurs when a PDF's embedded JavaScript writes annotation attributes without sufficient object-type and argument validation, corrupting the internal annotation structure so the application faults during subsequent object release (CWE-763). Local exploitation requires a user to open a crafted PDF; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. The vendor rates full confidentiality, integrity, and availability impact (CVSS 7.8), though Foxit tags it as Denial of Service.

Technical ContextAI

Foxit PDF Reader and Foxit PDF Editor embed a JavaScript engine that lets document scripts manipulate PDF objects such as annotations (the interactive markup, form, and link objects layered over page content). The defect is an object-type and argument confusion: when script sets annotation attributes, the application fails to validate the object type or arguments, leaving a dangling or invalid reference in the annotation's internal structure. CWE-763 (Release of Invalid Pointer or Reference) is the root-cause class - during later cleanup/free of that corrupted object the engine dereferences or frees an invalid pointer, producing a crash and, depending on heap state, potential memory corruption beyond a simple abort. Affected products per CPE are cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader and cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor.

RemediationAI

No exact fix version is provided in the input, so consult the Foxit security bulletin at https://www.foxit.com/support/security-bulletins.html for the patched release and upgrade Foxit PDF Reader and Foxit PDF Editor to the vendor-fixed version once identified (Patch available per vendor advisory; released patched version not independently confirmed here). As a compensating control until patched, disable JavaScript execution in Foxit (Preferences > JavaScript > uncheck 'Enable JavaScript Actions'), which directly removes the attack path since the flaw is triggered by document JavaScript writing annotation attributes - the trade-off is that legitimate interactive forms and scripted document features will stop working. Additionally, enable Safe/Protected Reading Mode and instruct users not to open untrusted PDFs; where feasible, filter or sandbox inbound PDFs at the mail/web gateway. Do not rely on version numbers not present in the input.