CVE-2026-57257: Foxit PDF Reader Out-of-Bounds Read Denial of Service

Technical summary

The vulnerability is an out-of-bounds read (CWE-125) occurring in the PRC parsing stage. During the parsing of PRC entity indices, the application fails to verify that the index value falls within valid array boundaries before dereferencing the entity array. This allows an attacker to craft a PRC structure with an out-of-range index that, when parsed, causes the application to read from invalid memory locations. The crash occurs in the parsing engine itself, making the denial of service deterministic once the malicious PDF is processed. The vulnerability affects Foxit PDF Editor and Foxit PDF Reader across Windows and macOS platforms.

Business impact

The primary impact is denial of service through application crash, which disrupts user productivity when opening PDFs from untrusted sources. For organizations relying on Foxit readers for document workflows, a widespread campaign distributing malicious PDFs could cause business interruption. The vulnerability also carries a minor information disclosure risk, as an out-of-bounds read can leak small amounts of process memory—though exploitation for data exfiltration is not practical given the crash condition. Foxit Reader is widely deployed in enterprises, making this vulnerability relevant to many organizations' risk profiles.

Affected systems

Foxit PDF Editor and Foxit PDF Reader are directly affected on both Windows and macOS. The exact affected versions are not specified in the advisory; verify against Foxit's official security bulletin for the precise version range. Microsoft Windows and Apple macOS themselves are not vulnerable—they are listed because Foxit products run on these operating systems. Organizations using alternative PDF readers (Adobe, Preview, etc.) are not affected by this specific flaw.

Exploitability

Exploitation requires local access and user interaction. An attacker must deliver a malicious PDF file to a victim—via email, web download, file sharing, or removable media—and convince or socially engineer the user into opening it with Foxit Reader or Editor. Once opened, the crash is immediate and deterministic. The attack surface is broad because PDF processing is common, but the barrier to exploitation (requiring user action) moderates the practical risk. There is no evidence of active exploitation in the wild, and the vulnerability is not on the KEV (Known Exploited Vulnerabilities) catalog.

Remediation

Apply security updates from Foxit as soon as they become available. Check Foxit's official security advisories for the patched versions of PDF Editor and Reader. In the interim, users should exercise caution when opening PDFs from untrusted sources and consider using alternative PDF readers if Foxit is not business-critical. Organizations should restrict PDF file sources through email gateways and endpoint controls where feasible. No workarounds exist; patching is the primary remediation.

Patch guidance

Monitor Foxit's security advisory channels for release announcements. When patches are published, validate the version numbers against Foxit's official documentation before deployment. Test patches in a non-production environment first, as PDF reader updates occasionally affect plugin compatibility or rendering behavior. Deploy via your standard software deployment pipeline to ensure broad coverage. Given the MEDIUM severity and lack of active exploitation, patches can follow your normal update schedule rather than emergency protocols, though prioritization within the next 30 days is prudent.

Detection guidance

Monitor for instances of Foxit PDF Reader or Editor crashing unexpectedly, particularly in correlation with PDF file opens from external sources. Endpoint Detection and Response (EDR) tools can flag repeated process crashes in foxit*.exe or related processes. Web proxies and email gateways should log PDF attachments by filename patterns (e.g., unusual or obfuscated names) to identify potential delivery vectors. Review user reports of 'PDF won't open' incidents. Note that a crash is the primary observable; memory corruption may not produce additional logging without specialized debugging enabled.

Why prioritize this

This vulnerability merits attention within 30–45 days but is not an immediate critical priority. The CVSS 6.1 MEDIUM score reflects the denial-of-service impact tempered by the requirement for user interaction and local access. The lack of KEV status and active exploitation evidence suggests limited immediate threat. However, because Foxit Reader is pervasive in enterprises and PDFs are a universal file type, the attack surface is significant. Prioritize patching over other MEDIUM-severity vulnerabilities if your organization has high Foxit adoption or frequently receives PDFs from external parties.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects: Attack Vector Local (AV:L)—attacker must already have or gain local file access; Attack Complexity Low (AC:L)—no special conditions required; Privileges Required None (PR:N)—any user can trigger the flaw; User Interaction Required (UI:R)—victim must open the malicious PDF; Scope Unchanged (S:U)—impact limited to the affected application; Confidentiality Low (C:L)—minor memory leak potential; Integrity None (I:N)—no data modification; Availability High (A:H)—application crash is a complete availability loss. The score balances the high availability impact against the modest barriers to exploitation.

Frequently asked questions