CVE-2026-57237 Overview
CVE-2026-57237 is a use-after-free vulnerability [CWE-416] affecting Foxit PDF Editor and Foxit PDF Reader on Windows and macOS. The flaw triggers when JavaScript embedded in a PDF modifies the properties of form fields. These modifications invalidate the state of underlying objects still referenced by the application. The program subsequently reads an illegal memory address, causing a crash and potentially enabling arbitrary code execution in the context of the current user.
Critical Impact
A crafted PDF can achieve local code execution with high impact to confidentiality, integrity, and availability when opened by a user in Foxit PDF Editor or Reader.
Affected Products
- Foxit PDF Editor (Windows and macOS)
- Foxit PDF Reader (Windows and macOS)
- Microsoft Windows and Apple macOS host platforms
Discovery Timeline
- 2026-07-08 - CVE-2026-57237 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-57237
Vulnerability Analysis
The vulnerability is a use-after-free condition in the PDF form-handling logic of Foxit PDF Editor and Reader. When a PDF document is opened, embedded JavaScript can programmatically modify the properties of AcroForm form field objects. These property changes invalidate internal object state that the application continues to reference. Later access to the freed or stale object results in a read from an illegal memory address.
Exploitation requires the victim to open a malicious PDF file, satisfying the user interaction requirement of the attack. While the direct observed impact is application crash through memory corruption, use-after-free conditions in PDF readers have historically been leveraged to achieve arbitrary code execution by manipulating heap layout prior to the dangling pointer dereference.
Root Cause
The root cause is improper lifetime management of form field objects during JavaScript-driven property modification. The application retains references to objects whose underlying state has been invalidated or freed, violating the reference invariants expected by downstream code paths in the AcroForm processing engine.
Attack Vector
The attack vector is local and requires user interaction. An attacker crafts a PDF document containing JavaScript that manipulates form field properties in a way that triggers the invalid object state. The attacker then delivers the file through email, drive-by download, chat, or another content-sharing channel. When the target opens the file in a vulnerable Foxit build, the application processes the embedded script and enters the vulnerable code path.
No verified proof-of-concept code is publicly available for CVE-2026-57237. Refer to the Foxit Security Bulletins for authoritative technical details.
Detection Methods for CVE-2026-57237
Indicators of Compromise
- Unexpected crashes of FoxitPDFEditor.exe or FoxitPDFReader.exe shortly after opening a PDF, particularly with access violation exceptions referencing form field or JavaScript engine modules.
- Windows Error Reporting or macOS crash reports citing invalid memory reads during AcroForm or JavaScript processing.
- PDF files containing AcroForm structures combined with JavaScript that iteratively modifies field properties such as value, type, or display.
Detection Strategies
- Inspect inbound PDFs at the mail gateway and web proxy for embedded /JavaScript and /JS entries combined with AcroForm dictionaries.
- Correlate Foxit process crashes with recent PDF open events using endpoint telemetry to identify potential exploitation attempts.
- Deploy YARA rules targeting suspicious PDF JavaScript patterns that iterate over AFForm or getField calls in unusual sequences.
Monitoring Recommendations
- Enable and forward Windows Application event logs and macOS crash reports from user endpoints to a central analytics platform.
- Monitor child process creation from Foxit binaries, which is not expected during normal document viewing.
- Alert on Foxit processes writing executables or scripts to disk, or making outbound network connections to non-Foxit domains.
How to Mitigate CVE-2026-57237
Immediate Actions Required
- Update Foxit PDF Editor and Foxit PDF Reader to the latest available release as published in the Foxit security bulletins.
- Restrict opening of PDF documents from untrusted sources and enforce email attachment scanning for PDF content.
- Communicate the risk to end users and instruct them not to open unsolicited PDF files.
Patch Information
Foxit publishes fixed versions and remediation guidance through its official advisory portal. Consult the Foxit Security Bulletins for the specific patched versions addressing CVE-2026-57237 and apply them across all Windows and macOS endpoints running Foxit PDF Editor or Reader.
Workarounds
- Disable JavaScript execution in Foxit PDF Editor and Reader via Preferences → JavaScript → Enable JavaScript Actions until patches are deployed.
- Enable Safe Reading Mode in Foxit to block unsafe actions such as embedded JavaScript execution and external content loading.
- Configure application control policies to limit the execution of Foxit binaries to trusted user contexts and prevent them from spawning child processes.
# Disable JavaScript in Foxit via Windows registry (per-user)
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
