CVE-2026-57259: Foxit PDF Reader/Editor XXE File Disclosure Vulnerability

Technical summary

CVE-2026-57259 is an XML External Entity (XXE) injection vulnerability (CWE-611) in Foxit PDF Editor and PDF Reader on Microsoft Windows. The underlying issue is insufficient input validation: the affected products do not require input files to be strictly valid PDF structures. Instead, after content review, the parser processes documents that masquerade as PDFs. An attacker crafts a malicious document containing external entity declarations that reference local file paths via protocol handlers (e.g., file:// URIs). When the parser evaluates these entities, it reads and exfiltrates local files accessible within the user's permission context. CVSS v3.1 score is 6.5 (Medium): network-accessible attack surface, low attack complexity, user interaction required, no privilege escalation, and high confidentiality impact balanced against no integrity or availability impact.

Business impact

An attacker can harvest sensitive documents, credentials, configuration files, or other locally stored data by sending a specially crafted PDF-like file to an organization's users. Unlike attacks requiring network access to backend systems, this targets the endpoint directly. For organizations where employees handle external PDFs (contractors, vendors, research teams), the risk is higher. Compromised local files—including SSH keys, API credentials, or internal documents—can enable lateral movement, privilege escalation, or downstream attacks. Remediation requires patching multiple Foxit products, creating operational overhead in large environments.

Affected systems

Foxit PDF Editor (all affected versions listed in vendor advisory) and Foxit PDF Reader (all affected versions) on Microsoft Windows are vulnerable. Users on non-Windows platforms or those using alternative PDF readers are not directly affected. Organizations must verify exact version boundaries against the official Foxit security advisory; this summary does not specify patch cutoff versions.

Exploitability

Exploitability is moderate. The attack requires a user to open a malicious file, but there is no requirement for elevated privileges or prior authentication. The attacker simply crafts the malicious document and distributes it (phishing, watering hole, etc.). Because many organizations routinely exchange PDF documents, and users may not scrutinize file origin carefully, this is a credible attack path. Public exploit code or automated weaponization is not yet widely reported, but the vulnerability is straightforward to reproduce once the XXE vector is understood. No KEV (Known Exploited Vulnerability) status currently assigned.

Remediation

Patch Foxit PDF Editor and Foxit PDF Reader to the versions specified in the vendor advisory. Until patching is complete, implement application-level mitigations: restrict PDF file opens via group policy, disable external entity processing if exposed as a product option, or disable network access for the Foxit processes via firewall rules (if operationally feasible). User awareness training on file provenance and suspicious file handling reduces user-level risk but does not eliminate the vulnerability.

Patch guidance

Contact Foxit and consult their official security advisory for specific patch version numbers and deployment instructions. Do not assume patch versions from this writeup. Apply patches in order: PDF Reader first if separate, then Editor. Test patched versions in a pilot group before enterprise rollout. Verify patch application with Foxit's integrity checks if available. Coordinate with your PDF workflow processes to minimize downtime.

Detection guidance

Monitor endpoint logs for Foxit process spawning or file I/O anomalies: unexpected reads of credential stores, .ssh directories, or configuration directories following PDF opens. Network detection is harder because file exfiltration may occur over existing HTTPS connections, but DNS or HTTP queries to unusual external hosts during/after PDF processing warrant investigation. Email gateway rules can flag .pdf attachments from untrusted sources, though this is broad. Endpoint detection and response (EDR) tools capable of process genealogy and file access context are most effective.

Why prioritize this

Medium CVSS and no known active exploitation suggest this is not an immediate critical incident, but it should be prioritized ahead of non-remote or UI-less vulnerabilities. The attack surface is broad (any user opening a PDF), and the impact (local file disclosure) can lead to credential theft and lateral movement. Organizations with high PDF traffic or sensitive local data should prioritize faster; those with restricted file sharing may defer slightly. The requirement for user interaction and limited initial impact do not justify deferral indefinitely.

Risk score, explained

CVSS 6.5 (Medium) reflects the network-accessible vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction needed (UI:R). The high confidentiality impact (C:H) is offset by no integrity or availability impact (I:N/A:N). This places it in the Medium band. For individual organizations, local context (employee roles, data sensitivity, PDF workflow prevalence) may warrant treating it as High priority internally despite the Medium base score.

Frequently asked questions