CVE-2026-57245: Foxit PDF Editor Use-After-Free Flaw

CVE-2026-57245 Overview

CVE-2026-57245 affects Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. The vulnerability triggers when the application opens a PDF and traverses annotation elements related to hyperlinks. The parser fails to validate abnormal annotation relationships and field combinations, leaving internal objects in an invalid state. During the destruction phase, the application performs an invalid pointer write, causing a crash and potential code execution. The flaw is classified under [CWE-416] (Use After Free) and requires user interaction to open a crafted PDF document.

Critical Impact
A crafted PDF opened by a local user can trigger an invalid pointer write leading to application crash and potential arbitrary code execution in the context of the current user.

Affected Products

Foxit PDF Editor on Microsoft Windows
Foxit PDF Reader on Microsoft Windows
Microsoft Windows platforms hosting affected Foxit installations

Discovery Timeline

2026-07-08 - CVE-2026-57245 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57245

Vulnerability Analysis

The vulnerability resides in the PDF annotation-handling logic responsible for hyperlink elements. When Foxit PDF Editor or Reader parses a document, it traverses the annotation tree and constructs in-memory objects that represent link actions, destinations, and associated fields. The parser does not validate combinations of annotation relationships and field values that fall outside expected schema constraints. A crafted PDF can therefore drive the internal object graph into an inconsistent state where object references no longer match the underlying allocations.

The defect manifests later, during teardown of these annotation objects. Destructor logic dereferences a pointer that references memory that has already been freed or was never valid, then performs a write to that location. This is a classic use-after-free condition per [CWE-416], and the write primitive can be steered by attacker-controlled data in the PDF.

Root Cause

The root cause is insufficient validation of annotation relationships and field combinations during hyperlink annotation construction. Because invalid states pass initial checks, ownership and lifetime assumptions in the destructor are violated. Instead of failing cleanly on malformed input, the code proceeds to destruction and issues an invalid pointer write.

Attack Vector

Exploitation requires a local user to open a malicious PDF in Foxit PDF Editor or Foxit PDF Reader. The CVSS vector indicates local attack vector with required user interaction. Successful exploitation can compromise confidentiality, integrity, and availability in the context of the user account running the application. Delivery methods include phishing emails with PDF attachments, drive-by downloads, and shared network file paths.

No verified public proof-of-concept code is available. The vulnerability manifests during the destruction phase of hyperlink annotation objects after malformed field combinations are processed. See the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2026-57245

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe following the opening of a PDF file, particularly with access violation exceptions on write operations.
Windows Error Reporting (WER) entries referencing Foxit binaries with exception code 0xC0000005 shortly after PDF interaction.
PDF files containing malformed or unusual hyperlink annotation dictionaries with inconsistent /Subtype, /A, or /Dest field combinations.

Detection Strategies

Inspect inbound PDF attachments using static analysis to flag documents with anomalous annotation structures referencing hyperlinks with invalid field pairings.
Correlate process crash telemetry from Foxit executables with recent PDF file opens by parent user sessions.
Monitor endpoint EDR telemetry for child process creation or memory allocation anomalies originating from Foxit processes after opening documents from untrusted sources.

Monitoring Recommendations

Enable and forward Windows Application event logs and WER crash dumps for Foxit processes to a centralized log platform for analysis.
Track PDF file provenance across email gateways, web proxies, and file shares to identify high-risk documents delivered to endpoints with vulnerable Foxit versions.
Alert on unusual outbound network activity or process spawning from Foxit executables, which may indicate post-exploitation activity following a successful invalid pointer write.

How to Mitigate CVE-2026-57245

Immediate Actions Required

Apply the security update from Foxit as soon as it is available for your deployed version of Foxit PDF Editor and Foxit PDF Reader on Windows.
Restrict opening of PDFs from untrusted sources until patching is complete, particularly documents received through email or external file transfer.
Inventory endpoints running Foxit PDF Editor or Reader and prioritize patch deployment based on user exposure to external content.

Patch Information

Refer to the Foxit Security Bulletins for the specific fixed versions of Foxit PDF Editor and Foxit PDF Reader that address CVE-2026-57245. Deploy the vendor-supplied installer or MSI package through your standard software distribution mechanism.

Workarounds

Configure email security gateways to sandbox or strip PDF attachments containing suspicious annotation structures until endpoints are patched.
Use an alternative PDF viewer with equivalent security controls for high-risk workflows involving externally sourced documents.
Enforce least-privilege user accounts so that any exploitation is contained to a non-administrative context, limiting downstream impact.

bash

# Query installed Foxit versions on Windows endpoints via PowerShell
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'Foxit*PDF*' } |
  Select-Object Name, Version, InstallDate