Description
After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
Published: 2026-07-08
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A PDF containing JavaScript that deletes a form field object after the document is opened triggers a use‑after‑free condition in Foxit PDF Editor and Foxit PDF Reader. When the application later attempts to use this invalid object, it crashes416 and results in a denial‑of‑service scenario by causing the reader to terminate unexpectedly.

Affected Systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader from Foxit Software Inc. No specific version range is provided in all released versions from the time of the advisory should be verified for the presence of the flaw.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity of the issue. The EPSS score of <1% shows a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploits are currently known. The likely attack vector is that an attacker supplies a malicious PDF that includes the offending JavaScript; when processed by the application the program to crash, interrupting service for the user.

Generated by OpenCVE AI on July 29, 2026 at 14:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Foxit PDF Editor and Foxit PDF Reader to the latest released versions that‑free flaw.
  • Disable JavaScript execution in the reader or editor settings until a patch is applied to prevent malicious script execution.
  • Run the PDF reader in a sandboxed or restricted environment to limit the impact of a potential crash or exploit.

Generated by OpenCVE AI on July 29, 2026 at 14:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
Title Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxitsoftware Foxit Pdf Editor Foxit Reader
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-07-08T13:18:08.981Z

Reserved: 2026-06-24T03:01:15.648Z

Link: CVE-2026-57238

cve-icon Vulnrichment

Updated: 2026-07-08T13:18:04.789Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T14:45:02Z

Weaknesses