CVE-2026-57251

Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability

The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bounds access to the underlying array is exposed, ultimately leading to a crash of the application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57249

Foxit PDF Editor/Reader Annotation Use-After-Free Vulnerability

After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action. During the re-entry process, the application access invalid objects and crashed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57248

Foxit PDF Editor/Reader Annotation Improper Release Vulnerability

When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the application to crash during subsequent release.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57246

Foxit PDF Editor/Reader Signature Buffer Overflow Vulnerability

When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but the signature plugin does not perform validation when copying the abnormal string, causing the application to crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57245

Foxit PDF Editor/Reader Signature Hyperlink Use-After-Free Vulnerability

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57243

Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability

During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the application to crash.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57242

Foxit PDF Editor/Reader Page Use-After-Free Vulnerability

The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57241

Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability

The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57238

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-13129

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-57240

Foxit PDF Editor/Reader Form Field Use-After-Free Remote Code Execution Vulnerability

When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid pointer references and causing the application to crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-13128

Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-13127

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-13126

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-56001

libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow

A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

X X.org

Products

Libxfont Libxfont

CVE-2026-56002

libXfont2 PCF Font Parsing Heap Buffer Overflow

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

X X.org

Products

Libxfont Libxfont Libxfont2

CVE-2026-56003

libXfont2 computeProps Property Buffer Heap Buffer Overflow

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

X X.org

Products

Libxfont Libxfont Libxfont2

CVE-2026-41042

Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.

CVSS 3.1 · 9.1 Critical EPSS 1.5% KEV · Not listed

Vendors

Apache

Products

Gravitino

CVE-2026-54061

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Dgraph

Products

Dgraph

CVE-2026-44840

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dgraph

Products

Dgraph