CVE-2026-57250: Foxit PDF Editor & Reader Use-After-Free Denial of Service

Technical summary

CVE-2026-57250 is a use-after-free vulnerability (CWE-416) in Foxit PDF Editor and PDF Reader that arises from insufficient input validation in PDF form-field handling. When JavaScript within a PDF invokes form-field reset operations, the script execution can cause re-entrancy into the PDF parsing/rendering interface, leaving the native object in a corrupted or freed state. Subsequent function calls on this damaged object result in a denial of service. The vulnerability affects both Windows and macOS versions of the affected Foxit products and requires user interaction (opening a PDF) to trigger.

Business impact

This vulnerability poses a denial-of-service risk to organizations relying on Foxit PDF tools for document processing. Attackers can disrupt workflows by distributing weaponized PDFs that crash the application, potentially causing data loss if unsaved work is in progress. In environments where PDF processing is automated or integrated into business systems, the crash could interrupt critical operations. The HIGH severity rating reflects the potential for repeated exploitation and the ease with which users might be social-engineered into opening a PDF file.

Affected systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader on both Windows and macOS platforms. Organizations using these products for PDF editing, viewing, or form handling are at risk. The scope is limited to these specific Foxit applications; other PDF readers or editors are not affected by this particular flaw. Determine the installed version and deployment scope within your environment to assess exposure.

Exploitability

Exploitation requires user interaction—a victim must open a specially crafted PDF file. The attack vector is local and does not require elevated privileges, making it straightforward for an attacker to deliver via email, file sharing, or web download. The complexity is low; creating a malicious PDF that triggers the JavaScript form-reset sequence is within the reach of competent threat actors. No CVSS score adjustment for user interaction has been applied, indicating that the impact severity alone justifies the HIGH rating despite the interaction requirement.

Remediation

Apply the security patch released by Foxit for both PDF Editor and PDF Reader. Verify the specific patched version number in the official Foxit security advisory. Until patching is complete, educate users to avoid opening PDF files from untrusted sources, particularly those unsolicited or from unfamiliar senders. Consider restricting PDF processing capabilities in high-risk environments or sandboxing PDF applications to limit the impact of a crash.

Patch guidance

Check Foxit's official security bulletin for the patched version of PDF Editor and PDF Reader applicable to your platform (Windows or macOS). Apply the update as soon as feasible, prioritizing systems in departments that frequently handle external PDFs. Verify patch deployment across all affected endpoints before closing this remediation ticket.

Detection guidance

Monitor for application crashes of Foxit PDF Editor and PDF Reader, especially when processing PDFs from external or untrusted sources. Endpoint detection and response (EDR) solutions can flag suspicious process terminations. Audit logs may show unexpected terminations of the Foxit process with no user-initiated close. Set up alerting for repeated crashes of these applications on the same system, which could indicate active exploitation attempts.

Why prioritize this

Although not yet on the CISA KEV catalog, this vulnerability merits urgent attention due to its HIGH CVSS score (7.8), ease of exploitation (no privilege escalation required, low complexity), and reliance on minimal user interaction. The use-after-free condition is a well-understood class of flaw with high impact. The local attack vector and user-interaction requirement place it in the 'patch soon' tier rather than 'patch immediately,' but it should not be deferred beyond standard critical patch cycles.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects three factors: (1) Attack Vector: Local—the attacker must induce the user to open a file, limiting scope but not eliminating risk; (2) Complexity: Low—crafting the malicious PDF is feasible without special conditions; (3) Impact: High across confidentiality, integrity, and availability—the crash can result in data loss, and a sophisticated attacker might chain this with other flaws. The score does not assume weaponization in the wild yet, but the mechanics are straightforward.

Frequently asked questions