What is the CVSS score of CVE-2026-57256?

CVE-2026-57256 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit Pdf Editor are affected by CVE-2026-57256?

Foxit PDF Reader and Editor contain a use-after-free vulnerability (CVE-2026-57256, CVSS 7.8) triggered by simply opening a malicious PDF document, requiring no special permissions or authentication.

How to fix or mitigate CVE-2026-57256?

24 hours: Conduct comprehensive inventory of Foxit PDF Reader and Editor installations across all systems; document all currently deployed versions; distribute security bulletin to users restricting opening of PDF files from external or untrusted sources. 7 days: Disable JavaScript functionality in Foxit PDF Reader and Editor via group policy or centralized configuration to eliminate the attack vector; conduct testing to ensure business-critical workflows remain functional with JavaScript disabled. 30 days: Establish monitoring of Foxit vendor security advisories for patch release; prepare deployment strategy for immediate patch application upon availability; evaluate and pilot alternative PDF readers for departments handling sensitive or high-risk documents.

Foxit Pdf Editor CVE-2026-57256

EUVD-2026-42192 HIGH

Use After Free (CWE-416)

2026-07-08 Foxit

GHSA-6m6w-86vv-j325

Denial Of Service Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Foxit) · only source for this CVE.

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 08:53 vuln.today

DescriptionCVE.org

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash.

AnalysisAI

Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing embedded JavaScript to trigger a use-after-free (CWE-416) when the script manipulates a list box field and the form is subsequently reset. A victim who merely opens the malicious document can have the application dereference a dangling pointer to freed form-field memory; Foxit itself reported the flaw and CVSS rates it 7.8. No public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis, though use-after-free in a scriptable PDF engine is a classic path toward code execution.