What is the CVSS score of CVE-2026-57260?

CVE-2026-57260 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit Pdf Editor are affected by CVE-2026-57260?

Foxit PDF Editor and Reader are vulnerable to code execution through crafted PDF attachments with no available vendor patch.

How to fix or mitigate CVE-2026-57260?

Within 24 hours: Issue mandatory security notice restricting PDF opening to internal sources; disable PDF auto-opening in email and messaging tools. Within 7 days: Complete inventory of Foxit deployments; pilot alternative PDF readers (Adobe Reader DC, Microsoft Edge). Within 30 days: Finalize remediation strategy (product replacement vs. sustained compensating controls); establish recurring monitoring of vendor advisory channels for patch release date.

Foxit Pdf Editor CVE-2026-57260

EUVD-2026-42189 HIGH

Out-of-bounds Write (CWE-787)

2026-07-08 Foxit

GHSA-95qp-ggjq-pxh6

Memory Corruption Buffer Overflow Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Foxit) · only source for this CVE.

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 08:51 vuln.today

DescriptionCVE.org

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.

AnalysisAI

Out-of-bounds memory access in Foxit PDF Editor and Foxit PDF Reader occurs when the application parses a malformed Unity 3D object embedded in a PDF, resolving attacker-influenced data as a pointer and dereferencing it as a valid address. A victim who opens a crafted PDF triggers the flaw (CVSS 7.8, UI:R), which manifests as a crash but, given the CWE-787 out-of-bounds write classification and High confidentiality/integrity/availability impact, carries potential for memory corruption and code execution in the context of the current user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.