CVE-2026-57244: Foxit PDF Reader/Editor Use-After-Free Crash Vulnerability

Technical summary

CVE-2026-57244 is a use-after-free vulnerability (CWE-416) affecting Foxit PDF Editor and Reader. The flaw occurs when JavaScript resets a form without proper re-entry protection and object lifecycle verification. During the pointer traversal process, the application fails to validate that referenced objects remain valid in memory. When the control pointer subsequently dereferences invalid memory, the application crashes. The vulnerability has a CVSS 3.1 score of 7.8 (HIGH) with local attack vector, low complexity, no privileges required, and user interaction needed. Impact includes confidentiality, integrity, and availability compromise.

Business impact

Denial of service is the primary impact. End users opening malicious PDF files in Foxit applications experience application crashes, disrupting document review workflows. While this is not a data theft or remote code execution vulnerability, the crash can be weaponized in social engineering campaigns or supply chain scenarios where PDFs are distributed to target organizations. Organizations relying on Foxit for secure PDF handling should assess user exposure and patch deployment feasibility to minimize workflow disruption.

Affected systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader across Windows and macOS platforms. Users of these applications on both operating systems are at risk when opening untrusted or adversarially-crafted PDF files. The specific affected versions and patch versions should be verified against the official Foxit security advisory.

Exploitability

Exploitation requires user interaction—specifically, a user must open a crafted PDF file in a vulnerable Foxit application. The attack vector is local, meaning the attacker must deliver the malicious PDF to the target. No authentication or special privileges are required on the victim's system. The barrier to exploitation is low; an attacker need only create a PDF that triggers the form reset condition through embedded JavaScript. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, but the straightforward nature of triggering a form reset suggests practical exploitability is achievable.

Remediation

Users should update Foxit PDF Editor and Foxit PDF Reader to patched versions as released by Foxit. Apply updates across all Windows and macOS deployments. Until patches are available, implement controls to prevent users from opening untrusted PDF files, such as disabling PDF previews in email clients or using file scanning to detect suspicious PDF characteristics. Consider enforcing use of alternative PDF readers that may not be vulnerable during the patching window.

Patch guidance

Check the official Foxit security advisory for the specific patched versions addressing CVE-2026-57244. Download and deploy updates from Foxit's website or through your organization's software distribution mechanism. Test patches in a non-production environment before broad rollout. Verify patch application by confirming the application version matches the patched release noted in the advisory. For organizations with slow patch cycles, prioritize this update for systems where users frequently handle external PDF files.

Detection guidance

Detection is challenging at the endpoint level because the vulnerability requires specific PDF content triggering the form reset. Monitor for Foxit application crashes in your event logs, particularly on systems handling PDF documents from external sources. Security Information and Event Management (SIEM) systems can aggregate application crash telemetry. Additionally, organizations may use PDF analysis tools to scan incoming files for suspicious JavaScript form manipulation patterns, though this requires proxy-level inspection. Network-based detection of specific PDF payloads is limited without deep packet inspection capabilities.

Why prioritize this

This vulnerability merits moderate-to-high prioritization due to its HIGH CVSS score and practical exploitability through user interaction. While not a remote code execution vulnerability, the denial of service impact combined with low exploitation complexity makes it attractive for attackers conducting disruption campaigns or social engineering. Organizations with Foxit deployments in high-volume document handling roles should prioritize patching. However, organizations where Foxit is used minimally or only internally for trusted documents may deprioritize relative to remote vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity rating. The score accounts for: local attack vector (typical for desktop applications), low attack complexity (form reset is a standard PDF feature), no privileges required, user interaction required, and impact to confidentiality, integrity, and availability (crash can disrupt operations and potentially expose memory contents). The severity is tempered by the requirement for user interaction but elevated by the broad impact scope and lack of access barriers.

Frequently asked questions