What is the CVSS score of CVE-2026-57260?

CVE-2026-57260 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit Pdf Editor are affected by CVE-2026-57260?

Foxit PDF Editor and Reader are vulnerable to code execution through crafted PDF attachments with no available vendor patch.

How to fix or mitigate CVE-2026-57260?

Within 24 hours: Issue mandatory security notice restricting PDF opening to internal sources; disable PDF auto-opening in email and messaging tools. Within 7 days: Complete inventory of Foxit deployments; pilot alternative PDF readers (Adobe Reader DC, Microsoft Edge). Within 30 days: Finalize remediation strategy (product replacement vs. sustained compensating controls); establish recurring monitoring of vendor advisory channels for patch release date.

Foxit Pdf Editor CVE-2026-57260

EUVD-2026-42189 HIGH

Out-of-bounds Write (CWE-787)

2026-07-08 Foxit

GHSA-95qp-ggjq-pxh6

Memory Corruption Buffer Overflow Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Foxit) · only source for this CVE.

CVSS VectorVendor: Foxit

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 08:51 vuln.today

DescriptionCVE.org

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.

AnalysisAI

Out-of-bounds memory access in Foxit PDF Editor and Foxit PDF Reader occurs when the application parses a malformed Unity 3D object embedded in a PDF, resolving attacker-influenced data as a pointer and dereferencing it as a valid address. A victim who opens a crafted PDF triggers the flaw (CVSS 7.8, UI:R), which manifests as a crash but, given the CWE-787 out-of-bounds write classification and High confidentiality/integrity/availability impact, carries potential for memory corruption and code execution in the context of the current user. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Issue mandatory security notice restricting PDF opening to internal sources; disable PDF auto-opening in email and messaging tools. …

Threat intelligence, references, and detailed analysis are available after sign-in.