CVE-2026-57237

HighCVSS 7.8/10Last modified Jul 9, 2026

Description

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.4 and earlier; Versions 13.2.4 and earlier
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.3 and earlier; Versions 13.2.3 and earlier
Foxit Software Inc.	Foxit PDF Reader	Versions 2026.1.1 and earlier

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572387.8After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, whi CVE-2026-572397.8The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the oppor CVE-2026-57246.3The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are CVE-2026-572407.8When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulti CVE-2026-572416.1The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the CVE-2026-572427.8The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management CVE-2026-572436.1During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, wi CVE-2026-572447.8After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in t CVE-2026-572457.8When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal anno CVE-2026-572467.8When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but th CVE-2026-572477.8The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objec CVE-2026-572487.8When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument ch