CVE-2026-57253

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

An abnormal image object causes the renderer to enter the wrong processing branch. When converting the scan lines, an invalid image buffer pointer is used, resulting in the application crashing.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.4 and earlier; Versions 13.2.4 and earlier
Foxit Software Inc.	Foxit PDF Reader	Versions 2026.1.1 and earlier

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572547.8There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform CVE-2026-572556.1The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The f CVE-2026-572567.8When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repea CVE-2026-572576.1During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the CVE-2026-572586.1The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains CVE-2026-572596.5The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document CVE-2026-57268.4ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2026-572607.8The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of CVE-2026-572626.8A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to e CVE-2026-572636.8A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores CVE-2026-572648.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572658.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var