CVE-2026-57240: Use-After-Free in Foxit PDF Reader and Editor

Technical summary

CVE-2026-57240 is a use-after-free vulnerability (CWE-416) occurring in Foxit PDF Editor and PDF Reader when processing PDF files containing JavaScript that deletes form fields. The application maintains pointers to PDF fields and does not properly validate their validity after JavaScript execution. When the application's post-JavaScript processing logic attempts to access the deleted fields via these stale pointers, invalid memory references occur, resulting in application crash. The vulnerability is triggered through local file access with user interaction (opening a PDF), affecting Windows systems running vulnerable versions of the Foxit products.

Business impact

An attacker can disrupt workflow by causing PDF editing or reading operations to fail unexpectedly. For organizations relying on Foxit for PDF processing, repeated crashes could impact productivity and document handling pipelines. If the vulnerability were exploited at scale through targeted PDF distribution, it could serve as a denial-of-service vector. The crash itself does not result in data theft or system compromise, but the underlying memory issue represents a stability and potential security concern that should be addressed promptly.

Affected systems

Foxit PDF Editor and Foxit PDF Reader are directly affected. The vulnerability is specific to Windows systems running these Foxit products. Microsoft Windows is listed in the affected vendors_products set, likely because the memory management and execution environment are Windows-specific factors. Users should verify the exact affected version ranges in Foxit's official security advisory, as the source data does not specify which versions are vulnerable.

Exploitability

Exploitability requires user interaction—a victim must open a crafted PDF file using Foxit PDF Editor or Reader. No elevated privileges or complex attack setup is needed; a phishing email or malicious website hosting the PDF is sufficient as an attack vector. The attack surface is broad because PDF opening is a common user action. However, the fact that the vulnerability is not yet on the CISA Known Exploited Vulnerabilities (KEV) catalog suggests active exploitation in the wild has not been widely documented at the time of publication.

Remediation

Apply the latest security patch from Foxit for both PDF Editor and PDF Reader. Users should update to patched versions as soon as they become available—verify specific version numbers against Foxit's official security advisory. As an interim measure, avoid opening PDFs from untrusted sources and consider disabling JavaScript execution in PDF readers if the workflow permits. Monitor for updates from Foxit and deploy them promptly across all affected systems.

Patch guidance

Contact Foxit and review their security advisories for CVE-2026-57240 to obtain the exact patched version numbers for PDF Editor and PDF Reader on Windows. Deploy patches through your standard change management process. Test the patched versions in a controlled environment before broad rollout to ensure compatibility with your PDF workflows and integrations. Enable automatic updates if available, or schedule regular update checks to catch future security releases.

Detection guidance

Monitor for application crashes in Foxit PDF Editor and Reader, particularly when processing PDFs from external or untrusted sources. Implement file integrity monitoring on systems where Foxit is deployed. Consider sandboxing PDF opening operations or restricting PDF handling to specific user roles. Log and alert on Foxit application errors and abnormal terminations. If JavaScript is not required in your PDF workflows, disable it in Foxit settings to reduce attack surface.

Why prioritize this

This vulnerability scores 7.8 (HIGH) on CVSS 3.1 due to the combination of local attack vector with user interaction, high impact across confidentiality, integrity, and availability (the vector shows C:H/I:H/A:H), and broad affected user base. While not yet in active exploitation per KEV status, the ease of delivery via email or web and the widespread use of PDF readers make it a meaningful near-term risk. Organizations should prioritize patching to prevent workflow disruption and to eliminate a memory safety issue that could evolve.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) Local Attack Vector—the PDF must be opened on the target system; (2) Low Attack Complexity—no special conditions needed once the PDF is opened; (3) No Privileges Required—the user opening the PDF needs no special rights; (4) User Interaction—the victim must open the malicious PDF; (5) High impact across all three CIA dimensions—the crash affects availability, but the underlying use-after-free could theoretically be extended to leak memory (confidentiality) or execute code (integrity). The HIGH severity rating appropriately captures the practical threat to systems running Foxit.

Frequently asked questions