CVE-2026-57243: Foxit PDF reentrancy vulnerability causes application crash (CVSS 6.1)

Technical summary

CVE-2026-57243 is a JavaScript reentrancy vulnerability in Foxit PDF Editor and PDF Reader triggered during the page opening and form formatting workflow. The vulnerability maps to CWE-125 (out-of-bounds read). When JavaScript code runs during document initialization, a reentrancy condition occurs, causing the application to maintain stale page metadata. Subsequent memory access operations reference invalid addresses based on this outdated state, leading to an out-of-bounds read that crashes the process. The vulnerability requires local file access and user interaction to trigger, making it a client-side attack vector.

Business impact

Organizations relying on Foxit PDF applications for document handling face potential workflow disruption through application crashes. While confidentiality impact is limited and integrity is not affected, the availability impact is significant—a crafted PDF can render the application unusable until restarted. For enterprises using Foxit as a primary PDF solution, an attacker could disrupt operations by distributing malicious PDFs via email or document sharing platforms. The limited scope (local application crash only, no system-wide impact) reduces severity, but the ease of triggering (requires only user interaction with a file) makes it operationally relevant.

Affected systems

Foxit PDF Editor and Foxit PDF Reader are the primary affected applications. The vulnerability listing also includes Microsoft Windows, likely reflecting that exploitation requires a Windows environment or that the underlying memory handling differs across platforms. Organizations should verify which Foxit product versions are deployed and whether PDF handling is integrated into other business workflows. End-user machines, document review stations, and automated PDF processing systems using these tools are at risk.

Exploitability

Exploitation is straightforward in terms of mechanics: an attacker crafts a PDF file containing malicious JavaScript designed to trigger reentrancy during form formatting, then distributes it to target users. The CVSS vector (AV:L/AC:L/PR:N/UI:R) reflects that local file access and user interaction are required, but no special privileges are needed. The attack surface is broad because PDF files are ubiquitous in business communication. However, real-world exploitation requires accurate knowledge of application internals to reliably trigger the reentrancy condition and construct a payload that crashes rather than simply behaving unexpectedly. This vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Organizations should patch Foxit PDF Editor and PDF Reader to the latest available version addressing this vulnerability. Verify patch availability through Foxit's official security advisories and test in a controlled environment before broad deployment. Until patches are available, mitigating controls include user awareness training to avoid opening PDFs from untrusted sources, restricting PDF handling to sandboxed environments where possible, and considering alternative PDF viewers for sensitive or untrusted documents. Disabling JavaScript execution in PDF documents, if supported by your Foxit configuration, may also reduce risk.

Patch guidance

Consult Foxit's official security bulletin and release notes for the specific patch version addressing CVE-2026-57243. Test the patch in a pilot environment against business-critical PDF workflows to ensure no compatibility issues before enterprise rollout. Given the MEDIUM severity and availability impact, prioritize deployment within 30–60 days. If patch timelines are unavailable, document the risk and implement compensating controls such as sandboxing or alternative tools for high-risk documents.

Detection guidance

Monitor for application crash events in Foxit PDF Editor and Reader, particularly those correlating with specific PDF file handling or form processing. Intrusion detection systems tuned to Foxit may flag malicious PDF characteristics if signatures are available. Endpoint detection and response (EDR) tools should log process crashes and memory access violations associated with Foxit processes. Behavioral analysis of PDF files before opening (content inspection, JavaScript scanning) can identify suspicious payloads. Log and track unusual PDF distribution patterns within your organization, especially unsolicited attachments containing embedded JavaScript.

Why prioritize this

Although CVE-2026-57243 carries MEDIUM severity and is not yet in active exploitation, it merits prompt attention due to its low attack complexity and reliance on a ubiquitous business activity (opening PDFs). The availability impact (application crash) can disrupt workflows, and the broad distribution surface of PDF files makes it a practical threat vector. Organizations should prioritize this within their normal patch cycle but need not elevate it to emergency status. The absence of integrity or confidentiality compromise and the requirement for user interaction keep it below the critical threshold.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects a vulnerability with moderate exploitability and limited scope. Attack Vector (Local) and Access Complexity (Low) indicate that an attacker needs only to deliver a file to a local system; no network or privilege escalation is required. User Interaction (Required) acknowledges the need to trick a user into opening the PDF. Availability (High) captures the denial-of-service impact of the crash. Confidentiality (Low) and Integrity (None) reflect that the crash does not leak sensitive data or alter files. The score appropriately balances the ease of triggering against the limited scope and impact, placing it in the MEDIUM range where remediation should be planned but not treated as an emergency.

Frequently asked questions