Foxit PDF Reader CVE-2026-57254

Exploitation requires the victim to open an attacker-supplied PDF in Foxit PDF Reader or Foxit PDF Editor (UI:R - user interaction is mandatory), and the PDF must contain an abnormal annotation object cross-referenced by other objects in a way that defeats the parser's type checking. No authentication or elevated privileges are needed (PR:N), but the local attack vector (AV:L) means the attacker cannot trigger this remotely without first getting the file onto the target and having the user open it. Limiting factors: the mandatory user interaction, the need to deliver the crafted file, and the client-side (non-server, non-network-service) nature of the software constrain realistic exploitation to social-engineering-style delivery rather than automated remote compromise.

The CVSS 3.1 base is 7.8, vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local vector, low complexity, no privileges, but mandatory user interaction. There is a notable internal conflict in the signals: the vector claims High confidentiality and integrity impact (implying code execution or data disclosure), yet the description and Foxit's own tags describe only a crash ('Denial Of Service', 'Memory Corruption'). This discrepancy should be verified with the vendor - the C:H/I:H rating likely reflects the exploitable potential of the type-confusion primitive rather than a demonstrated read/write, while observed behavior is DoS. No EPSS score, SSVC decision, KEV status, or POC was provided, so there is no evidence of active or automatable exploitation; the local vector plus required user interaction further limit mass exploitation. Realistic priority is moderate: a widely deployed client with a memory-corruption bug that could plausibly be escalated, but no confirmed exploitation and a social-engineering delivery dependency.

An attacker crafts a PDF whose annotation object is malformed so that it is referenced by other objects under an incompatible type, then delivers it via email attachment or web download. When the victim opens the file in Foxit PDF Reader or Editor, the parser mishandles the annotation type and corrupts memory, crashing the application; given the CWE-843 type-confusion class, a carefully shaped variant could potentially be developed toward code execution, though no POC is currently identified.