CVE-2026-57248

Published: Jul 8, 2026Modified: Jul 9, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 14984358-7092-470d-8f34-ade47a7658a2 (Secondary)

Description

When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the application to crash during subsequent release.

Affected (7)

Products: Foxit: Pdf Editor, Pdf Reader

Foxit

2 products

Pdf Editor

Pdf Reader

Configuration A

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Foxit Pdf Editor	Up to 13.2.4.24048
Foxit Pdf Editor	From 14.0.0.33046 to 14.0.4.33508
Foxit Pdf Editor	From 2023.1.0.15510 to 2023.3.0.23028
Foxit Pdf Editor	From 2024.1.0.23997 to 2024.4.1.27687
Foxit Pdf Editor	From 2025.1.0.27937 to 2025.3.0.35737
Foxit Pdf Editor	From 2026.1.0.36452 to 2026.1.1.36485
Foxit Pdf Reader	Up to 2026.1.1.36485

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-763

Release of Invalid Pointer or Reference

The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

References (1)

https://www.foxit.com/support/security-bulletins.html

Source: 14984358-7092-470d-8f34-ade47a7658a2

Vendor Advisory

Timeline

No history available yet.