CVE-2026-57241: Out-of-Bounds Read in Foxit PDF Reader and Editor

Technical summary

CVE-2026-57241 is an out-of-bounds read vulnerability (CWE-125) in Foxit's PDF processing stack. The root cause is a synchronization failure between JavaScript-modifiable page objects and the renderer's internal state tracking. When JavaScript performs document manipulation operations, the in-memory representation of pages becomes inconsistent with the renderer's cached page count. The renderer does not re-validate this metadata before dereferencing page indices, resulting in an out-of-bounds memory access. The attack vector is local, requires no privileges, but does require user interaction (opening a crafted PDF). The impact is limited to availability; no information disclosure or code execution is indicated by the CVSS vector.

Business impact

An attacker can deliver a malicious PDF file to employees via email or shared document repositories. Opening the PDF in Foxit Reader or Editor causes an immediate crash, disrupting workflow and potentially causing loss of unsaved work. In environments where PDF processing is automated or integrated into document management systems, this could trigger repeated crashes in batch operations. The CVSS score of 6.1 (Medium) reflects the availability impact being material but containable—no system compromise or data exfiltration occurs. However, the ease of exploitation (local, no privileges, user action) means the practical risk is proportional to PDF file volume and trust in document sources.

Affected systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader across supported versions. The vulnerability also affects Windows systems, which serve as the platform host. Organizations using Foxit products for PDF viewing or editing in any capacity are in scope. Adobe Reader users are not affected. The risk is highest for organizations with high PDF document intake (finance, legal, healthcare) and those using Foxit Reader in deployment scenarios where crash resilience is important.

Exploitability

Exploitation is straightforward: an attacker crafts a PDF file with embedded JavaScript that modifies page-related objects within the document structure. The JavaScript must perform operations that cause desynchronization between page metadata and the renderer's internal page count tracking. No special execution context, privilege escalation, or out-of-bounds write is required—the attacker simply needs to deliver the PDF and convince or trick a user into opening it. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that exploitation requires minimal complexity and is repeatable across vulnerable versions. No public exploit code or in-the-wild activity has been reported as of the publication date.

Remediation

Vendors Foxit and Microsoft should issue patches that restore synchronization between JavaScript-modifiable page objects and the renderer's page metadata. The fix likely involves either disabling JavaScript access to page object manipulation, re-validating page counts before renderer operations, or enforcing bounds checks on page index dereferencing. Users should apply patches from Foxit (for PDF Editor and Reader) and Microsoft (for Windows platform support) as they become available. Until patching is complete, consider restricting PDF opening to trusted document sources and disabling JavaScript execution in Foxit settings if supported.

Patch guidance

Monitor Foxit's official security advisory channels for updated versions of PDF Editor and Reader that address CVE-2026-57241. Verify that patches are applied to the full product line (both Editor and Reader). Windows patches should be installed through standard Windows Update. Test patches in a non-production environment before wide deployment to confirm functionality is not disrupted. Foxit patches may require manual deployment depending on your organization's configuration management practices.

Detection guidance

Monitor for repeated or unexpected crashes of Foxit Reader or Editor processes, especially if clustered around document opening events or batch PDF processing. Collect process crash logs and correlate them with PDF file delivery or ingestion events. If forensic analysis is possible, inspect crash dumps for out-of-bounds access patterns or memory violations in Foxit's renderer modules. Monitor file ingestion and sharing channels (email gateways, document repositories, external collaboration tools) for PDF files with unusual characteristics or from untrusted sources. Alert on any PDF file opening attempts that result in application termination.

Why prioritize this

This vulnerability should be prioritized for patching because it affects widely-deployed consumer and enterprise PDF software, has a straightforward attack vector (email or file share), and requires only user interaction to trigger. While the impact is availability-only (no code execution), the ease of exploitation and user-facing nature mean attackers will likely craft proof-of-concepts quickly. Organizations with high PDF document volumes or those that rely on Foxit for automated PDF processing should prioritize patches within 30 days. Organizations with lower PDF risk profiles may defer patching to their standard maintenance windows, provided user education on trusted document sources is reinforced.

Risk score, explained

The CVSS 3.1 score of 6.1 (Medium) reflects a moderate-severity availability impact. The vector AV:L/AC:L/PR:N/UI:R indicates: Attack Vector is Local (user must open the PDF on their own system), Attack Complexity is Low (no special conditions required), Privilege escalation is not required, but User Interaction is required (must open the file). Confidentiality impact is Low (limited information may be leaked via crash state or memory errors), Integrity is None (no data modification), and Availability is High (application crash). This scoring is appropriate: exploitation is reliable but not widespread, and impact is limited to service disruption.

Frequently asked questions