CVE-2026-12057: Foxit AI Sandbox Escape Arbitrary Code Execution Vulnerability

Technical summary

CVE-2026-12057 is a sandbox escape vulnerability in Foxit AI's PDF JavaScript execution environment. The vulnerability stems from incomplete interface filtering in the sandbox layer that processes embedded scripts. Specifically, dangerous interfaces that should be intercepted are not adequately blocked, allowing JavaScript within a PDF to load and execute remote code. The attack vector is local with user interaction required (opening a malicious PDF), but the impact is severe: arbitrary code execution with full system compromise potential. The CVSS 3.1 score of 8.6 reflects the high severity due to the combination of high confidentiality, integrity, and availability impact across the system boundary.

Business impact

This vulnerability poses a significant risk to organizations where users routinely open PDF documents from untrusted or semi-trusted sources. An attacker can craft a malicious PDF that, when opened in Foxit AI, executes arbitrary code with user privileges—potentially enabling data theft, malware installation, lateral movement to other systems, or ransomware deployment. The requirement for user interaction (opening the PDF) makes social engineering a viable attack vector. For enterprises managing sensitive documents or receiving PDFs from external parties, this represents a direct path to endpoint compromise.

Affected systems

Foxit AI is affected by this vulnerability. Users should verify the specific version scope against the vendor advisory to determine which installations require immediate patching. The vulnerability affects any endpoint running a vulnerable version of Foxit AI where users may receive or open untrusted PDF files.

Exploitability

Exploitation requires local access and user interaction—specifically, a user must open a crafted malicious PDF in Foxit AI. The barrier to exploitation is moderate: while social engineering is necessary to trick a user into opening the file, the attack is reliable once the PDF is opened, and no special privileges or complex timing are required. The sandbox bypass is likely deterministic once triggered. This makes the vulnerability practically exploitable in real-world attack scenarios, particularly against targeted recipients or via broad mass-distribution campaigns.

Remediation

Organizations should prioritize patching Foxit AI to the latest available version that addresses this vulnerability. Until patching is complete, users should be advised to avoid opening PDF files from untrusted sources and to treat PDF attachments with the same caution as executable files. Consider restricting PDF opening to trusted internal documents only, and implement application whitelisting or sandboxing at the endpoint level to contain potential damage if a malicious PDF is executed.

Patch guidance

Check the Foxit AI security advisories and vendor release notes to identify the patched version that addresses CVE-2026-12057. Deploy the update through your standard patch management process. Test in a non-production environment first to ensure compatibility with your document workflows. Given the high CVSS score and active exploitation potential, prioritize this patch for rollout within 2–4 weeks depending on your organization's risk posture.

Detection guidance

Monitor for suspicious process spawning or network connections originating from Foxit AI processes, especially requests to download or execute code from external hosts. Behavioral detection tools should flag instances where JavaScript in a PDF triggers unusual system calls or child process creation. Endpoint detection and response (EDR) solutions should alert on Foxit AI launching shells, interpreters, or making unexpected network requests. Log PDF file opens from external or high-risk sources and correlate with subsequent suspicious activity.

Why prioritize this

The CVSS 8.6 HIGH severity score reflects the severe impact of arbitrary code execution with full system compromise. The vulnerability requires only local access and user interaction, making it practically exploitable via phishing or document-sharing workflows. Although not yet listed in CISA's KEV catalog, the combination of ease of delivery (malicious PDFs are common attack vectors) and severe impact warrants immediate prioritization, particularly for organizations handling sensitive documents or exposed to targeted threats.

Risk score, explained

The 8.6 CVSS 3.1 score is justified by the attack vector (local), low complexity, no privileges required, and requirement for user interaction (UI:R), combined with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) with a scope change (S:C). This scoring reflects that once a malicious PDF is opened, an attacker gains unrestricted code execution. The score is appropriate for a sandbox bypass in a document processing application where PDFs are routine business objects.

Frequently asked questions