What is the CVSS score of CVE-2026-57255?

CVE-2026-57255 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.1%.

Foxit PDF Reader CVE-2026-57255

EUVD-2026-42198 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-08 Foxit

GHSA-v89h-gff2-h39j

Buffer Overflow Information Disclosure Foxit Pdf Editor Foxit Pdf Reader

6.1

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

vuln.today AI

6.1 MEDIUM

File-based delivery requires local open (AV:L, UI:R); no credentials needed (PR:N); crash dominates impact (A:H) with minor memory-leak risk (C:L); no integrity or scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:27 vuln.today

DescriptionCVE.org

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application.

AnalysisAI

Out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader crashes the application and exposes limited memory contents when a victim opens a specially crafted PDF embedding a semantically malformed color space function. Affected versions span multiple branches across both Editor and Reader products, confirmed through EUVD-2026-42198. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and file-based delivery mechanism make this a plausible phishing lure in targeted campaigns against organizations relying on Foxit products.

Technical ContextAI

The vulnerability exists in the PDF color space processing subsystem of Foxit PDF Editor and Foxit PDF Reader, identified via CPE strings cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*:*:*:*:*:*:*:*. In the PDF specification, color spaces may reference function objects to dynamically compute color component values during rendering. The root cause, classified as CWE-125 (Out-of-Bounds Read), is the application's failure to validate the output of such a function before using it as a memory pointer. A PDF with an abnormal color space can supply a valid but semantically malformed function whose output falls outside expected bounds; when the renderer subsequently dereferences the resulting illegal pointer, it reads from memory outside the intended buffer. This produces a crash (high availability impact, A:H in CVSS) and may expose memory contents to a local process observing the failure (low confidentiality impact, C:L).

RemediationAI

Users should visit the Foxit security bulletins page at https://www.foxit.com/support/security-bulletins.html and upgrade to the latest patched release for their installed branch - no specific fixed version number was confirmed in the available intelligence, so consulting the vendor advisory directly is required to identify the exact target version. Users on the 13.x branch should upgrade beyond 13.2.4; users on 14.x should upgrade beyond 14.0.4; users on the 2026.x branch should upgrade beyond 2026.1.1. As a compensating control, organizations can configure email security gateways and web proxies to sandbox or quarantine PDF attachments from external or untrusted sources before delivery to endpoints, reducing the probability of a victim opening a malicious file without eliminating the underlying vulnerability. Running Foxit PDF applications within an OS-level sandbox or restricted user environment limits the blast radius of a crash or potential memory disclosure to the sandboxed process. These compensating controls do not eliminate the root cause and should be treated as interim measures until patching is complete.