Foxit PDF Editor CVE-2026-57249

Exploitation requires the victim to open a specially crafted PDF in Foxit PDF Editor or Foxit PDF Reader (UI:R in the vector), and that PDF must contain embedded JavaScript/additional actions that first reset annotation status and then trigger a reset-form additional action - the exact sequence that drives the re-entry into freed objects. This means JavaScript/additional-action processing must be enabled (Foxit's default), so disabling JavaScript or enabling Safe Reading Mode is a hard limiting factor; the attack vector is local/file-based (AV:L, no network service is exposed), and no authentication or elevated privileges are needed on the target (PR:N).

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) models a local, low-complexity, unauthenticated attack requiring user interaction (opening a file), with full confidentiality/integrity/availability impact - consistent with memory corruption that could go beyond a crash. Note a tension in the source data: the description explicitly states only that the application 'crashed' (a denial-of-service outcome), while the vector claims C:H/I:H, and the vendor tags include both 'Denial Of Service' and 'Memory Corruption'/'Use After Free' - verify with Foxit whether code execution is actually achievable or whether the C/I:H rating is precautionary. There is no EPSS score, no KEV listing, and no POC in the provided data, so this is not evidence of widespread or active exploitation; realistically it is a client-side, single-victim risk gated by social engineering (the user must open a malicious PDF). Priority is moderate: patch in normal cycles for high-value endpoints, sooner where Foxit is broadly deployed and users routinely open untrusted PDFs.

An attacker emails or hosts a booby-trapped PDF whose embedded JavaScript resets annotation status and then invokes a reset-form additional action; when the victim opens it in a vulnerable Foxit build, the re-entry path dereferences a freed object and the application crashes (denial of service), with potential for further memory-corruption exploitation. No public exploit code was identified at time of analysis, and successful exploitation requires the user to open the file.