CVE-2026-57255

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.4 and earlier; Versions 13.2.4 and earlier
Foxit Software Inc.	Foxit PDF Reader	Versions 2026.1.1 and earlier

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572567.8When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repea CVE-2026-572576.1During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the CVE-2026-572586.1The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains CVE-2026-572596.5The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document CVE-2026-57268.4ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2026-572607.8The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of CVE-2026-572626.8A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to e CVE-2026-572636.8A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores CVE-2026-572648.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572658.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572668.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572678.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var