CVE-2026-57244 Overview
CVE-2026-57244 is a use-after-free vulnerability [CWE-416] affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows and Apple macOS. After JavaScript resets a form, the synchronization process lacks re-entry protection and object lifecycle verification. A control pointer becomes invalid during traversal but continues to be dereferenced, causing the application to crash and potentially enabling arbitrary code execution.
Exploitation requires a local user to open a crafted PDF document. The flaw affects confidentiality, integrity, and availability of the host process.
Critical Impact
A crafted PDF can trigger a use-after-free in Foxit PDF Editor and Reader, leading to application crash or arbitrary code execution in the context of the current user.
Affected Products
- Foxit PDF Editor on Microsoft Windows and Apple macOS
- Foxit PDF Reader on Microsoft Windows and Apple macOS
- Deployments where JavaScript execution in PDFs is enabled
Discovery Timeline
- 2026-07-08 - CVE-2026-57244 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-57244
Vulnerability Analysis
The vulnerability resides in the form synchronization routine invoked after a JavaScript-triggered form reset. When the reset handler executes, the application walks a list of form control objects to synchronize their state. The routine holds a raw pointer to a control while traversing sibling and child structures.
Because the reset operation can be re-entered through embedded JavaScript callbacks, an attacker can arrange for the underlying control object to be freed mid-traversal. The synchronization code does not verify the object lifecycle before continuing. The now-dangling pointer is dereferenced, corrupting memory or transferring execution to attacker-controlled data.
Root Cause
Two defects combine to produce the flaw. First, the form reset synchronization path lacks re-entry protection, allowing nested JavaScript execution to modify the object graph while a traversal is in progress. Second, the traversal loop performs no lifecycle check on cached control pointers between iterations. This is a classic use-after-free pattern classified under [CWE-416].
Attack Vector
Exploitation requires user interaction: the victim must open a malicious PDF in a vulnerable version of Foxit PDF Editor or Reader. The PDF embeds JavaScript that invokes a form reset and re-enters the synchronization logic through form field callbacks, freeing a targeted control object. Subsequent dereference of the stale pointer yields memory corruption in the context of the local user. The attack vector is local and does not require prior authentication.
No verified public exploit code is available for this issue. See the Foxit Security Bulletins for technical details as they are published by the vendor.
Detection Methods for CVE-2026-57244
Indicators of Compromise
- Unexpected crashes of FoxitPDFEditor.exe or FoxitPDFReader.exe shortly after opening a PDF containing form JavaScript
- Windows Error Reporting or macOS crash logs referencing access violations during form field synchronization
- PDF files containing /AA, /OpenAction, or form reset JavaScript delivered via email or web download from untrusted sources
Detection Strategies
- Inspect inbound PDF attachments for JavaScript actions invoking resetForm combined with dynamic field manipulation
- Correlate Foxit process crash events with recent PDF open activity to identify potential exploitation attempts
- Alert on child processes spawned by FoxitPDFEditor.exe or FoxitPDFReader.exe, which is anomalous for document viewing
Monitoring Recommendations
- Enable crash dump collection on endpoints running Foxit products to support post-incident triage
- Monitor endpoint EDR telemetry for suspicious memory allocations, RWX regions, or shellcode indicators inside Foxit processes
- Track file reputation and origin metadata on PDFs opened by high-value users
How to Mitigate CVE-2026-57244
Immediate Actions Required
- Identify all endpoints running Foxit PDF Editor or Foxit PDF Reader on Windows and macOS
- Apply the vendor-supplied update once available from the Foxit Security Bulletins
- Restrict opening of PDFs from untrusted sources until patching is complete
Patch Information
Foxit publishes fixed versions and remediation details on the Foxit Security Bulletins page. Administrators should map installed builds against the vendor's fixed version list and deploy updates through their standard software distribution channel.
Workarounds
- Disable JavaScript execution in Foxit PDF Editor and Reader via Preferences → JavaScript → uncheck "Enable JavaScript Actions"
- Enable Safe Reading Mode to restrict potentially harmful actions in untrusted PDFs
- Use application allowlisting or attack surface reduction rules to block child process creation from Foxit processes
# Configuration example: disable Foxit JavaScript via registry on Windows
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
