CVE-2026-57258

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains elements and reads them, leading to out-of-bounds reads and application crashes.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.4 and earlier; Versions 13.2.4 and earlier
Foxit Software Inc.	Foxit PDF Editor	Versions 2026.1.1 and earlier; Versions 14.0.3 and earlier; Versions 13.2.3 and earlier
Foxit Software Inc.	Foxit PDF Reader	Versions 2026.1.1 and earlier

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-572596.5The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document CVE-2026-57268.4ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2026-572607.8The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of CVE-2026-572626.8A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to e CVE-2026-572636.8A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores CVE-2026-572648.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572658.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572668.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572678.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572688.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-572698.3GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-57275.4The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the pl