CVE-2026-57241

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.4 and earlier; Versions 13.2.4 and earlier
Foxit Software Inc.	Foxit PDF Reader	Versions 2026.1.1 and earlier

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572427.8The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management CVE-2026-572436.1During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, wi CVE-2026-572447.8After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in t CVE-2026-572457.8When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal anno CVE-2026-572467.8When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but th CVE-2026-572477.8The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objec CVE-2026-572487.8When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument ch CVE-2026-572497.8After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional a CVE-2026-57256.1The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all CVE-2026-572507.8When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is CVE-2026-572517.8The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistenc CVE-2026-572527.8When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause th