CVE-2026-57238

HighCVSS 7.8/10Last modified Jul 9, 2026

Description

After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-572397.8The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opporCVE-2026-57246.3The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are CVE-2026-572407.8When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resultiCVE-2026-572416.1The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the CVE-2026-572427.8The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle managementCVE-2026-572436.1During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, wiCVE-2026-572447.8After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in tCVE-2026-572457.8When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annoCVE-2026-572467.8When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but thCVE-2026-572477.8The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objecCVE-2026-572487.8When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument chCVE-2026-572497.8After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional a