CVE-2026-57245: Foxit PDF Editor & Reader Use-After-Free Denial-of-Service

Technical summary

CVE-2026-57245 is a use-after-free vulnerability (CWE-416) affecting Foxit PDF Editor and Foxit PDF Reader. The vulnerability stems from insufficient validation of PDF annotation relationships and field combinations during hyperlink annotation processing. When a PDF with malformed annotation elements is opened, the application fails to sanitize these objects, leading to an invalid internal state. During resource cleanup and object destruction, an invalid pointer write is triggered, resulting in application termination. The vulnerability is reachable through user interaction (opening a PDF) without requiring elevated privileges.

Business impact

This vulnerability poses a denial-of-service risk to organizations relying on Foxit PDF tools for document processing and review. While it does not enable data theft or system compromise, the crash can disrupt workflows and productivity. More critically, the underlying memory corruption could potentially be weaponized by skilled attackers; the current manifestation as a crash may mask deeper exploitation potential. Organizations should treat this as a priority remediation item given Foxit's prevalence in regulated industries and the ease of delivery via email or file-sharing mechanisms.

Affected systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows systems. Both consumer and enterprise editions of these products are in scope. Users on other operating systems (macOS, Linux) should verify patch status with Foxit to confirm whether those versions are also affected. The flaw is triggered only when a user opens a malicious PDF, so air-gapped systems or those with strict PDF handling policies face lower immediate risk.

Exploitability

Exploitability is straightforward and does not require sophisticated technical skills. An attacker needs only to craft a PDF with malformed hyperlink annotation relationships and deliver it to a target user. Social engineering or phishing campaigns could effectively distribute such files. The requirement for user interaction (opening the PDF) is the primary barrier, though this is a low bar in typical business environments where PDF handling is routine. No privilege escalation or network access is required. The CVSS vector (AV:L/AC:L/PR:N/UI:R) reflects these characteristics.

Remediation

Immediate action: Update Foxit PDF Editor and Foxit PDF Reader to the latest patched version available from Foxit's official website. Verify against the vendor advisory to confirm which version number resolves CVE-2026-57245. Interim mitigation: Disable or restrict hyperlink processing in PDFs where possible through application settings. Educate users not to open PDF files from untrusted sources. Consider deploying PDF sandboxing or analysis tools to scan incoming PDFs before they reach end users. Apply the patch to both applications, as the flaw affects both.

Patch guidance

Check Foxit's security advisory and release notes for the specific version number that addresses CVE-2026-57245. Apply patches to all instances of Foxit PDF Editor and Foxit PDF Reader across your environment. Test the patched version in a non-production environment first to ensure compatibility with your workflows and any PDF-dependent integrations. Schedule patch deployment during regular maintenance windows. For enterprise deployments, prioritize systems that handle external or untrusted PDFs first.

Detection guidance

Monitor application crash logs and event viewer entries for Foxit PDF Reader and Foxit PDF Editor terminations. Correlate crashes with specific PDF file characteristics or sources to identify potential attack patterns. Implement endpoint detection and response (EDR) tools to capture process memory states and exception details at crash time. Network-level detection is limited; focus on file integrity monitoring and anomalous PDF receipt patterns. User reporting of unexpected application crashes when opening specific PDFs may be an early indicator of exploitation attempts.

Why prioritize this

Although this vulnerability does not appear on the CISA KEV catalog, it merits immediate attention due to the combination of ease of exploitation, wide user base of affected software, and the memory corruption aspect. The HIGH CVSS score (7.8) reflects multiple privilege paths: confidentiality, integrity, and availability impacts are all marked as high, suggesting the underlying memory issue could be leveraged for more severe attacks. Foxit products are ubiquitous in enterprises, making this a broad-reach risk. Prioritize patching Foxit tools before patching lower-CVSS vulnerabilities in less-exposed applications.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is justified by multiple factors: the attack vector is local but easily triggered through normal user behavior; attack complexity is low; no privileges are required; and the impact rating is high across all three dimensions (confidentiality, integrity, availability). While the current observable impact is denial-of-service, the use-after-free condition suggests potential for memory disclosure or code execution if the vulnerability is refined. This score appropriately elevates the risk profile above moderate DoS-only flaws.

Frequently asked questions