CVE-2026-57238: Foxit PDF Editor DOS Vulnerability

CVE-2026-57238 Overview

CVE-2026-57238 is a use-after-free vulnerability [CWE-416] affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. The flaw occurs when a crafted PDF uses JavaScript to delete a form field object, then subsequently accesses the freed object. This dangling reference causes the application to crash and can be leveraged for arbitrary code execution in the context of the current user.

Exploitation requires a local user to open a malicious PDF file. The vulnerability targets memory management in the JavaScript engine's handling of form field objects.

Critical Impact
A crafted PDF can trigger memory corruption in Foxit PDF Editor and Reader, enabling code execution with the privileges of the user opening the document.

Affected Products

Foxit PDF Editor on Microsoft Windows
Foxit PDF Reader on Microsoft Windows
Microsoft Windows (host operating system)

Discovery Timeline

2026-07-08 - CVE-2026-57238 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57238

Vulnerability Analysis

The vulnerability resides in the JavaScript execution engine embedded within Foxit PDF Editor and Reader. PDF documents can execute embedded JavaScript to manipulate form fields, annotations, and other document objects. When the JavaScript code deletes a form field object, the underlying memory is freed but references to that object may persist elsewhere in the application.

Subsequent access through the stale reference constitutes a classic use-after-free condition [CWE-416]. The freed memory region can be reallocated and populated with attacker-controlled data before the dangling reference is dereferenced. This grants the attacker control over object internals, including virtual function tables and pointer fields that the application will act upon.

Root Cause

The root cause is missing lifecycle management between the JavaScript bindings and the native form field object representation. Deletion of the form field frees the native object without invalidating JavaScript-accessible references. The engine fails to nullify or reference-count these handles before returning control to the script context.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a specially crafted PDF through phishing email, a compromised website, or a shared file location. When the victim opens the document in a vulnerable Foxit product, the embedded JavaScript executes automatically and triggers the use-after-free condition. Successful exploitation yields code execution at the privilege level of the user account running the PDF application.

The vulnerability manifests through JavaScript API calls that remove form field objects followed by property access on the deleted object. No public proof-of-concept exploit is currently available. See the Foxit Security Bulletins for vendor-provided technical details.

Detection Methods for CVE-2026-57238

Indicators of Compromise

Unexpected crashes of FoxitPDFEditor.exe or FoxitPDFReader.exe process, particularly when opening PDF files from untrusted sources
PDF files containing JavaScript actions that invoke removeField() or deleteField() followed by field property access
Child processes spawned by Foxit PDF applications, such as cmd.exe, powershell.exe, or rundll32.exe
Windows Error Reporting entries referencing access violations in Foxit modules

Detection Strategies

Inspect PDF files for embedded JavaScript that combines form field deletion APIs with subsequent property reads on the deleted object
Monitor endpoint telemetry for anomalous process trees originating from Foxit PDF applications
Correlate email gateway logs with endpoint execution events to identify PDF attachments preceding suspicious activity

Monitoring Recommendations

Enable process creation auditing (Windows Event ID 4688) with command-line logging on endpoints running Foxit products
Forward crash dump events (Application Error 1000) referencing Foxit binaries to your SIEM for review
Track file downloads with the .pdf extension from external sources and correlate with subsequent process behavior

How to Mitigate CVE-2026-57238

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the latest patched versions published in the Foxit Security Bulletins
Restrict PDF attachments at email gateways pending deployment of the patched version
Communicate the risk to end users and instruct them not to open PDFs from unverified senders

Patch Information

Foxit has published fixes through its security bulletins portal. Refer to the Foxit Security Bulletins for the exact fixed versions and download links for Foxit PDF Editor and Foxit PDF Reader.

Workarounds

Disable JavaScript execution in Foxit PDF Editor and Reader via Preferences > JavaScript > Enable JavaScript Actions until patches are applied
Configure Foxit Safe Reading Mode to restrict execution of active content in untrusted PDFs
Use application allowlisting to prevent Foxit processes from spawning shell interpreters or scripting hosts

bash

# Registry configuration to disable JavaScript in Foxit PDF Editor (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JSPrefs" /v bJSEnable /t REG_DWORD /d 0 /f

# Enable Safe Reading Mode
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\Trust Manager" /v bSafeMode /t REG_DWORD /d 1 /f