CVE-2026-57243: Foxit PDF Editor DoS Vulnerability

CVE-2026-57243 Overview

CVE-2026-57243 affects Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. The vulnerability occurs during page opening and form formatting operations. A JavaScript reentrancy condition produces an inconsistent document state. The application then references outdated page information and reads from invalid memory addresses, leading to a crash.

The issue is classified under [CWE-125] Out-of-Bounds Read. Exploitation requires local access and user interaction, such as opening a crafted PDF containing malicious JavaScript. Successful exploitation results in application termination and denial of service on the affected host.

Critical Impact
Attackers can crash Foxit PDF Editor or Reader by delivering a crafted PDF that triggers JavaScript reentrancy during form formatting, causing an out-of-bounds read.

Affected Products

Foxit PDF Editor on Microsoft Windows
Foxit PDF Reader on Microsoft Windows
Microsoft Windows platform (as host environment)

Discovery Timeline

2026-07-08 - CVE-2026-57243 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57243

Vulnerability Analysis

The flaw resides in the JavaScript execution flow that runs while a PDF is being opened and its form fields are being formatted. Foxit PDF Editor and Reader expose a rich JavaScript API for interacting with document objects, form fields, and page content. When JavaScript embedded in the PDF triggers a callback that reenters the document processing routine before the initial operation completes, the internal document state becomes inconsistent.

After the reentrant call returns, the outer routine continues using cached page references that no longer reflect the current document layout. This mismatch results in an out-of-bounds read [CWE-125] as the application dereferences pointers that point outside the valid page structure. The read triggers an access violation and terminates the process.

Root Cause

The root cause is missing synchronization and state validation between the document processing pipeline and the embedded JavaScript engine. Neither the outer page-opening routine nor the form-formatting routine re-validates page metadata after JavaScript executes. The application trusts stale offsets and pointers, permitting reads beyond the intended buffer boundary.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a PDF file containing JavaScript that triggers reentrancy during page open or field formatting events such as AFDate_FormatEx, AFNumber_Format, or custom Format action scripts. The victim opens the file in Foxit PDF Editor or Reader. The malicious script forces the document into an inconsistent state, and the application crashes when it accesses invalid memory. No verified public proof-of-concept is available at this time. See the Foxit Security Bulletins for technical details.

Detection Methods for CVE-2026-57243

Indicators of Compromise

Unexpected termination of FoxitPDFEditor.exe or FoxitPDFReader.exe shortly after a PDF is opened.
Windows Error Reporting (WER) entries citing access violations in Foxit modules during document load.
PDF files containing form fields with AA (Additional Actions) dictionaries invoking JavaScript that reopens or reformats pages.

Detection Strategies

Inspect PDFs at ingress for embedded JavaScript that references page manipulation APIs such as this.pageNum, this.getField, or Doc.closeDoc inside format callbacks.
Correlate process crash events (Event ID 1000) referencing Foxit binaries with recent PDF open activity from mail or browser download sources.
Hunt for repeated Foxit process crashes across multiple hosts, which may indicate distribution of a malicious PDF.

Monitoring Recommendations

Enable application crash telemetry and forward WER data to a central SIEM for correlation.
Monitor endpoint EDR telemetry for parent-child chains where a browser or mail client spawns Foxit followed by an abnormal exit.
Track file reputation and hash signals for inbound PDFs, especially those with embedded scripts.

How to Mitigate CVE-2026-57243

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the vendor advisory.
Restrict opening of untrusted PDF files, particularly those received via email or downloaded from external sources.
Disable JavaScript execution in Foxit PDF Editor and Reader for users who do not require it.

Patch Information

Foxit has published fixes through its security bulletin process. Refer to the Foxit Security Bulletins for the specific patched versions addressing CVE-2026-57243 and apply the update on all Windows endpoints running Foxit PDF Editor or Reader.

Workarounds

Disable JavaScript under Preferences > JavaScript in Foxit PDF Editor and Reader until patching is complete.
Enable Safe Reading Mode to block execution of embedded active content in PDFs from untrusted locations.
Route inbound PDFs through a content disarm and reconstruction (CDR) gateway that strips embedded JavaScript.

bash

# Configuration example: disable JavaScript via Windows registry for Foxit PDF Editor
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v "bEnableJS" /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v "bEnableJS" /t REG_DWORD /d 0 /f