CVE-2026-57245

Published: Jul 8, 2026Modified: Jul 9, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 14984358-7092-470d-8f34-ade47a7658a2 (Secondary)

Description

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.

Affected (7)

Products: Foxit: Pdf Editor, Pdf Reader

Foxit

2 products

Pdf Editor

Pdf Reader

Configuration A

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Foxit Pdf Editor	version ≤ 13.2.4.24048
Foxit Pdf Editor	14.0.0.33046 ≤ version ≤ 14.0.4.33508
Foxit Pdf Editor	2023.1.0.15510 ≤ version ≤ 2023.3.0.23028
Foxit Pdf Editor	2024.1.0.23997 ≤ version ≤ 2024.4.1.27687
Foxit Pdf Editor	2025.1.0.27937 ≤ version ≤ 2025.3.0.35737
Foxit Pdf Editor	2026.1.0.36452 ≤ version ≤ 2026.1.1.36485
Foxit Pdf Reader	version ≤ 2026.1.1.36485

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (1)

https://www.foxit.com/support/security-bulletins.html

Source: 14984358-7092-470d-8f34-ade47a7658a2

Vendor Advisory

Timeline

No history available yet.