CVE-2026-57241 Overview
CVE-2026-57241 is an out-of-bounds read vulnerability [CWE-125] affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. The flaw occurs when the application opens a crafted PDF and embedded JavaScript performs operations on the page and document. These operations desynchronize page-related objects while the renderer continues to trust an outdated page count. The application then performs out-of-bounds access and crashes. Exploitation requires a local user to open a malicious PDF, making this a user-interaction attack against document viewers.
Critical Impact
A crafted PDF containing malicious JavaScript can crash Foxit PDF Editor or Reader through out-of-bounds memory access, producing a denial-of-service condition on the victim's Windows host.
Affected Products
- Foxit PDF Editor on Microsoft Windows
- Foxit PDF Reader on Microsoft Windows
- Microsoft Windows (host operating system)
Discovery Timeline
- 2026-07-08 - CVE-2026-57241 published to the National Vulnerability Database (NVD)
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-57241
Vulnerability Analysis
The vulnerability lives in the interaction between the Foxit PDF JavaScript engine and the internal representation of PDF pages. When a document is opened, the renderer caches metadata about the document, including the total page count. Embedded JavaScript can invoke document and page APIs that add, remove, or reorder pages during rendering. These mutations update some object state but leave the cached page count and related object references stale.
When the renderer subsequently indexes into the page collection using the outdated page count, it dereferences memory outside the valid bounds of the current page array. This produces an out-of-bounds read [CWE-125] that terminates the process. The issue is a state synchronization defect between mutable document objects and the renderer's assumptions about immutable document geometry.
Root Cause
The root cause is missing invalidation of cached page metadata after JavaScript-driven document mutations. Foxit's PDF engine trusts the initial page count for the lifetime of a rendering operation. Scripted calls that alter page structure do not force the renderer to re-read the current count, so bounds checks operate on stale values.
Attack Vector
Exploitation requires the victim to open a malicious PDF locally in Foxit PDF Editor or Reader. The attacker embeds JavaScript that manipulates pages and document state to trigger the desynchronization. The CVSS vector indicates local access with required user interaction and a high availability impact, consistent with an application crash rather than code execution. No confidentiality or integrity impact is documented.
No verified public proof-of-concept code is available. Refer to the Foxit Security Bulletins for vendor technical details.
Detection Methods for CVE-2026-57241
Indicators of Compromise
- Repeated crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe recorded in the Windows Application event log with access violation exception codes.
- Windows Error Reporting (WER) entries referencing out-of-bounds read faults in Foxit rendering modules shortly after a PDF is opened.
- PDF files containing /JavaScript or /JS objects that call this.deletePages, this.insertPages, or this.movePage in unusual sequences.
Detection Strategies
- Inspect inbound PDFs at the email gateway and web proxy for embedded JavaScript that mutates page structure, and quarantine samples that combine scripting with page manipulation APIs.
- Correlate Foxit process crash events with the file path of the most recently opened PDF using endpoint telemetry to identify the triggering document.
- Hunt for user-opened PDFs delivered from external sources immediately followed by abnormal termination of Foxit processes.
Monitoring Recommendations
- Forward Windows Application and WER logs to a centralized SIEM and alert on Foxit process crashes exceeding a low baseline threshold.
- Track PDF file provenance across email, web download, and removable media channels to prioritize investigation of documents from untrusted senders.
- Monitor for repeated crashes from a single user, which may indicate targeted delivery of a malicious PDF.
How to Mitigate CVE-2026-57241
Immediate Actions Required
- Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the vendor advisory as soon as they are validated for your environment.
- Disable JavaScript execution in Foxit until patches are deployed, since the vulnerability requires script-driven page manipulation to trigger.
- Restrict opening of PDFs from untrusted sources and route external documents through a sandboxed viewer or protected view.
Patch Information
Foxit publishes fixed versions and remediation details through its security bulletin portal. Review the Foxit Security Bulletins for the specific build numbers that address CVE-2026-57241 and apply the update across all managed Windows endpoints running Foxit PDF Editor or Reader.
Workarounds
- Turn off JavaScript in Foxit by navigating to File > Preferences > JavaScript and clearing Enable JavaScript Actions.
- Use Group Policy or application configuration management to enforce the JavaScript-disabled setting across the fleet.
- Deploy attachment filtering rules that strip or block PDFs containing embedded JavaScript from external senders.
# Registry configuration example to disable JavaScript in Foxit PDF Reader on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
