Foxit PDF Reader CVE-2026-57253

The victim must open a specially crafted PDF file containing a malformed image object using Foxit PDF Reader or Foxit PDF Editor on an affected version branch (Reader ≤ 2026.1.1; Editor ≤ 2026.1.1, ≤ 14.0.4, or ≤ 13.2.4). The CVSS vector (UI:R) confirms that user interaction - actively opening or rendering the file - is a hard prerequisite; the vulnerability cannot be triggered remotely without this action. No authentication, network service exposure, or special application configuration is required beyond the user opening the malicious file. The primary limiting factors are: (1) the local attack vector (AV:L), meaning the file must be accessible on the local system or presented to the user for opening; (2) mandatory user interaction; and (3) the scope is constrained to the Foxit process itself (S:U), so compromise does not automatically extend to the operating system or other applications.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H accurately captures the constrained attack surface: exploitation requires the victim to open a locally-accessible file, and no privileges are required of the attacker, but user interaction is mandatory. The high availability impact (A:H) is the dominant risk signal - reliable application crash is confirmed by the description. The low confidentiality impact (C:L) aligns with CWE-125, where out-of-bounds reads can leak partial memory contents, though exploit reliability for information disclosure is unconfirmed. No EPSS score is provided in the intelligence data. Critically, this vulnerability is not listed in CISA KEV and no public POC is identified, meaning the real-world threat level remains theoretical. SSVC signals: exploitation status is 'none', the attack is not automatable at scale (requires user interaction with a crafted file), and technical impact is partial (crash plus possible minor disclosure). Overall, this is a genuine Medium-priority patching item for organizations using Foxit software - not an emergency, but the multiple affected version branches and broad product footprint make patch application prudent.

An attacker crafts a PDF document embedding a malformed image object with abnormal metadata designed to direct the Foxit renderer into the vulnerable processing branch. The file is delivered to a target via email attachment or a file-sharing link, and when the victim opens it in Foxit PDF Reader or Editor, the renderer dereferences an invalid scan line buffer pointer, immediately crashing the application. A more capable attacker could refine the image object construction to control which out-of-bounds memory region is read, potentially leaking heap layout data useful for further exploitation, though no public proof-of-concept demonstrating this has been identified.