Foxit PDF Reader CVE-2026-57259

The victim must actively open a maliciously crafted file using Foxit PDF Editor or Foxit PDF Reader - this is the sole prerequisite enforced by UI:R in the CVSS vector. The document does not need to conform to a valid PDF structure; any file the application will parse is sufficient, which broadens the attack surface beyond strict PDF files. The attacker requires a delivery vector (email, web download, USB, shared drive) and typically an out-of-band channel to receive exfiltrated data (HTTP/DNS callback to an internet-reachable host). Exploitation is limited to files readable by the OS user account running the Foxit application; administrator or root-owned files outside the user's permission scope cannot be accessed. No special application feature, plugin, or non-default configuration is required - default installations of the affected versions are vulnerable.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 Medium, which fairly reflects the risk profile: network-deliverable with no authentication required, but constrained by mandatory user interaction. The C:H metric is significant - successful exploitation grants read access to any file within the victim's OS permission scope, which on a typical workstation could include SSH keys, browser credential stores, configuration files, and sensitive documents. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. No KEV listing means CISA has not confirmed active exploitation; no POC is referenced, making current exploitation unlikely to be widespread. The scope is Unchanged (S:U), meaning the impact is bounded to the victim's own session - lateral movement or privilege escalation are not inherent to this CVE. The primary real-world risk is targeted spear-phishing delivering a crafted file to harvest credentials or intellectual property from a specific user. Low-complexity delivery (AC:L) and no required privileges (PR:N) mean the attack barrier is low once a victim is identified.

An attacker sends a phishing email to a target employee with an attachment disguised as a PDF invoice or contract; the file contains malicious XXE entity declarations referencing sensitive paths such as C:\Users\victim\.ssh\id_rsa or /home/victim/.aws/credentials. When the victim opens the file in Foxit PDF Reader or Editor, the parser resolves the external entities, reads the target files, and the attacker receives the exfiltrated content via a DNS or HTTP callback to an attacker-controlled server. No public POC for this specific CVE has been identified at time of analysis.