CVE-2026-57237: Foxit PDF Use-After-Free Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-57237 is a use-after-free vulnerability (CWE-416) that occurs when JavaScript embedded in a PDF document modifies form field properties without proper synchronization of the underlying object state. The vulnerability results in a denial-of-service condition as the application attempts to dereference invalidated memory pointers. The attack vector is local; it requires user interaction to open a crafted PDF file. The CVSS 3.1 score of 7.8 (HIGH) reflects the potential for confidentiality, integrity, and availability impact, though exploitation is constrained by the need for user action and local access.

Business impact

Organizations relying on Foxit PDF Editor or Reader for document processing face disruption risk from denial-of-service attacks. If an attacker sends a malicious PDF to employees, opening it will crash the application, interrupting workflows. In environments where PDF processing is critical—legal firms, financial institutions, healthcare providers—repeated crashes degrade productivity. The vulnerability does not enable data theft or unauthorized modifications to documents, but the crash itself may corrupt unsaved work. The requirement for user interaction limits mass exploitation but does not eliminate the risk in targeted scenarios.

Affected systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader across Windows and macOS platforms. The CVSS vector indicates local attack surface, meaning the threat actor must achieve local code execution context or convince a user to open a malicious file. Both products are widely deployed; organizations should inventory their Foxit installations and verify which versions are in use. The operating system itself (Windows or macOS) is listed as an affected vendor but is not the root cause; rather, it provides the execution environment for the vulnerable PDF application.

Exploitability

Exploitation requires crafting a PDF file containing JavaScript that manipulates form field properties in a specific manner to trigger the use-after-free condition. The attacker must convince or trick a user into opening the file. No known public exploit code has been designated for inclusion in the CISA KEV catalog (KEV status is false), indicating that widespread, weaponized exploitation has not been documented at the time of publication. However, the technical barrier to exploitation is moderate; security researchers with PDF and JavaScript knowledge could develop a proof-of-concept. The reliance on user action significantly reduces the attack surface compared to remote code execution vulnerabilities.

Remediation

Foxit has released security updates to address this vulnerability. Organizations should obtain and apply the latest version of Foxit PDF Editor or Foxit PDF Reader from the official vendor. Verify the specific patch version against Foxit's security advisory or update notification. Until patches are applied, mitigate risk by educating users not to open PDF files from untrusted sources, disabling JavaScript execution in PDF readers where operationally feasible, or restricting PDF file access via email filtering or content scanning. No workaround eliminates the vulnerability without patching.

Patch guidance

Check Foxit's official security announcements and update mechanisms within the application or via the vendor portal. Administrators should test patches in a staging environment before production deployment, particularly if the organization has custom workflows or integrations dependent on Foxit. Automated patch management tools should be configured to prioritize Foxit updates. Given the HIGH CVSS severity, patches should be deployed within 2–4 weeks of availability. Document the patch version applied and maintain a log of affected systems for compliance purposes.

Detection guidance

Monitor for repeated or unusual Foxit PDF Editor/Reader crashes, particularly if correlated with receipt of PDF files from external sources or during specific business processes. Endpoint detection and response (EDR) tools may flag access violations or memory corruption events. Log analysis of application crashes can reveal patterns consistent with targeted attack. Additionally, threat intelligence feeds may provide indicators of compromise associated with malicious PDF campaigns. If possible, enable logging of PDF file operations and JavaScript execution events within Foxit, though this feature availability varies by version.

Why prioritize this

Although KEV inclusion status is false, the HIGH CVSS score (7.8), combined with the widespread use of Foxit PDF products in enterprises, warrants priority remediation. The use-after-free vulnerability class (CWE-416) is a common attack vector for privilege escalation and code execution in other contexts; vigilance is warranted in case new variants emerge. The reliance on user interaction is a mitigating factor, but targeted phishing or watering-hole attacks could activate this vulnerability at scale. Organizations with high-value intellectual property or sensitive document workflows should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Attack Vector Local (AV:L) indicates local system access is required. Attack Complexity Low (AC:L) means no special conditions are needed once the attacker can execute code. Privileges Required None (PR:N) indicates no elevated privileges are needed. User Interaction Required (UI:R) means the victim must open the crafted file. Scope Unchanged (S:U) limits impact to the vulnerable component. The High impact ratings for Confidentiality, Integrity, and Availability reflect the theoretical potential for data exposure and system compromise via a use-after-free, though the practical manifestation observed is denial of service. The score appropriately balances the accessibility of the attack with its potential severity.

Frequently asked questions