Description
The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bounds access to the underlying array is exposed, ultimately leading to a crash of the application.
Published: 2026-07-08
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Foxit PDF Editor and Foxit PDF Reader contain a cloud‑like appearance rendering path that expands an internal array without setting an upper bound or performing consistency checks. This defect enables an out‑of‑bounds array read that ultimately crashes the application when a malicious PDF is processed. The vulnerability is classified as CWE‑129 and does not provide a delivery mechanism for arbitrary code execution, limiting its effect to a denial of service.

Affected Systems

The affected products are Foxit PDF Editor and Foxit PDF Reader. The CVE does not specify affected versions, so users should consult Foxit’s security bulletins or verify the installed build number against vendor‑provided advisories.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity flaw, while the EPSS score of <1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. The attack method is inferred to be the normal PDF opening workflow; an attacker would need to supply a specifically crafted PDF to a victim’s machine. No public exploit code is documented, and the flaw does not offer a direct code‑execution path.

Generated by OpenCVE AI on July 29, 2026 at 14:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Foxit PDF Editor or Foxit PDF Reader updates to install the vendor‑published patch.
  • Avoid opening PDFs from untrusted or unknown sources until a patch is applied.
  • Regularly monitor Foxit’s security bulletins at https://www.foxit.com/support/security-bulletins.html for updates and further guidance.

Generated by OpenCVE AI on July 29, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 08 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bounds access to the underlying array is exposed, ultimately leading to a crash of the application.
Title Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability
Weaknesses CWE-129
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxitsoftware Foxit Pdf Editor Foxit Reader
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-07-08T12:41:07.653Z

Reserved: 2026-06-24T03:01:18.717Z

Link: CVE-2026-57251

cve-icon Vulnrichment

Updated: 2026-07-08T12:40:57.720Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T14:45:02Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index