What is the CVSS score of CVE-2026-57259?

CVE-2026-57259 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Foxit PDF Reader CVE-2026-57259

EUVD-2026-42197 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-07-08 Foxit

GHSA-cp35-rwwj-hqqf

XXE Foxit Pdf Editor Foxit Pdf Reader

6.5

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered file requires only user interaction to trigger; no privileges needed; confidentiality-only impact bounded to user's permission scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:23 vuln.today

DescriptionCVE.org

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local paths, thereby allowing access to any local files within the user's permission range.

AnalysisAI

XXE injection in Foxit PDF Editor and Foxit PDF Reader exposes any local file readable by the victim user when they open a maliciously crafted document disguised as a PDF. The parser processes documents that are not structurally valid PDFs, resolving attacker-controlled external XML entities that reference local filesystem paths via file:// or similar protocols, enabling out-of-band exfiltration of sensitive local files. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by user interaction (UI:R), limiting opportunistic mass exploitation.

Technical ContextAI

CWE-611 (Improper Restriction of XML External Entity Reference) describes a class of flaw where an XML parser resolves externally defined entities without restriction. Foxit PDF Editor and Foxit PDF Reader accept documents that are not structurally valid PDFs - the parser processes the embedded XML/document content regardless of strict format conformance. An attacker embeds malicious external entity declarations (<!ENTITY xxe SYSTEM 'file:///etc/passwd'>) inside such a document; when the parser expands these entities, it reads the referenced local file and can surface the contents in rendered output or via side-channel. Affected CPEs are cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*:*:*:*:*:*:*:*, covering all versions up to the patched releases per EUVD-2026-42197.

RemediationAI

Upgrade Foxit PDF Editor and Foxit PDF Reader to the versions published in Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html. Exact fixed version numbers are not independently confirmed from the available input data - consult the bulletin directly for the specific patched release for your product branch (13.x, 14.x, or 2026.x). As a compensating control while patching, configure your mail gateway and endpoint DLP solution to quarantine or sandbox PDF and PDF-disguised documents before delivery, reducing the chance a user opens a weaponized file. Disabling network egress from the Foxit process (via application-layer firewall rules) would prevent out-of-band exfiltration even if XXE entity expansion occurs, though this may interfere with legitimate online PDF features. Organizations should treat any PDF from untrusted sources as potentially malicious until patched.