Description
After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
Published: 2026-07-08
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A PDF containing JavaScript that deletes a form field object after the document is opened triggers a use‑after‑free condition (CWE‑416) in Foxit PDF Editor and Foxit PDF Reader. When the application later attempts to use this invalid object, it crashes, resulting in a denial‑of‑service scenario by causing the reader to terminate unexpectedly.

Affected Systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader from Foxit Software Inc. No specific version range is provided in all released versions from the time of the advisory should be verified for the presence of the flaw.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity of the issue. The EPSS score of <1% shows a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploits are currently known. The likely attack vector is that an attacker supplies a malicious PDF that includes the offending JavaScript; when processed by the application the program crashes, interrupting service for the user.

Generated by OpenCVE AI on August 3, 2026 at 04:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Foxit PDF Editor and Foxit PDF Reader to the latest released versions that‑free flaw.
  • Disable JavaScript execution in the reader or editor settings until a patch is applied to prevent malicious script execution.
  • Run the PDF reader in a sandboxed or restricted environment to limit the impact of a potential crash or exploit.

Generated by OpenCVE AI on August 3, 2026 at 04:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
Title Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxit Pdf Editor Pdf Reader
Foxitsoftware Foxit Pdf Editor Foxit Reader
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-07-08T13:18:08.981Z

Reserved: 2026-06-24T03:01:15.648Z

Link: CVE-2026-57238

cve-icon Vulnrichment

Updated: 2026-07-08T13:18:04.789Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-08T09:16:31.693

Modified: 2026-07-09T14:22:01.103

Link: CVE-2026-57238

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T05:00:16Z

Weaknesses