CVE-2026-57247: Foxit PDF Editor Use-After-Free Flaw

CVE-2026-57247 Overview

CVE-2026-57247 is a use-after-free vulnerability [CWE-416] affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows and Apple macOS. The application re-enters the document structure during field processing and deletes the current page, then continues to use field objects obtained before deletion. This dangling reference triggers an illegal read that can lead to a crash or arbitrary code execution in the context of the user.

Exploitation requires a user to open a crafted PDF document. The vulnerability affects both confidentiality and integrity, and can be used to run attacker-controlled code on the victim workstation.

Critical Impact
Attackers can achieve local code execution by convincing a user to open a malicious PDF file processed by a vulnerable Foxit application.

Affected Products

Foxit PDF Editor on Microsoft Windows and Apple macOS
Foxit PDF Reader on Microsoft Windows and Apple macOS
Applications embedding vulnerable Foxit PDF rendering components

Discovery Timeline

2026-07-08 - CVE-2026-57247 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57247

Vulnerability Analysis

The flaw is a use-after-free condition in the field processing logic of Foxit PDF Editor and Reader. During processing of a PDF form field, the application re-enters the document structure and executes an action that deletes the current page. Field object pointers acquired before the deletion remain in scope and are dereferenced after the backing memory has been freed.

The subsequent read against freed memory yields an illegal access. Because attackers control the layout of the freed region through PDF content, the condition can be shaped into a controlled read or write primitive. Successful exploitation results in code execution with the privileges of the user opening the document.

Root Cause

The root cause is a lifetime management error in field handling. The renderer caches raw pointers or references to field objects owned by the page and does not invalidate them when the containing page is destroyed as a side effect of nested field processing. There is no reference count, weak reference, or generation check that would detect reuse of a stale object.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a specially crafted PDF through email, a web download, or a shared repository. When the target opens the document in Foxit PDF Editor or Reader, the crafted form field triggers the reentrant deletion path and the subsequent dereference of freed field objects.

The vulnerability affects the desktop applications on Windows and macOS. No network authentication is required, and no elevated privileges are needed on the local system.

See the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2026-57247

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe with access violation exceptions referencing freed heap memory
PDF files containing form fields with JavaScript actions that programmatically remove pages during field events
Foxit process spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on macOS
Outbound network connections initiated by the Foxit process shortly after opening an untrusted PDF

Detection Strategies

Monitor Foxit application processes for abnormal termination codes consistent with heap corruption
Inspect PDF attachments for embedded JavaScript that calls page deletion APIs during field processing events
Correlate PDF open events with subsequent process creation, memory injection, or file write activity from the Foxit binary

Monitoring Recommendations

Enable endpoint detection and response telemetry for process, file, and network events on hosts running Foxit software
Ingest Windows Error Reporting and macOS crash logs into a central SIEM to spot repeated crashes in Foxit modules
Alert on Foxit processes performing script interpretation, memory allocation anomalies, or lateral movement patterns

How to Mitigate CVE-2026-57247

Immediate Actions Required

Inventory all endpoints with Foxit PDF Editor and Foxit PDF Reader installed and identify affected versions
Apply the latest Foxit security update as published in the vendor security bulletins
Restrict opening of PDF files from untrusted sources and enforce attachment scanning at the mail gateway
Disable JavaScript execution in Foxit PDF Editor and Reader for users who do not require it

Patch Information

Foxit has published fixes through its security bulletin process. Refer to the Foxit Security Bulletins page for the specific fixed versions of Foxit PDF Editor and Foxit PDF Reader on Windows and macOS, and deploy the updates through your standard software distribution mechanism.

Workarounds

Disable JavaScript in Foxit preferences under Preferences > JavaScript to block the field-processing path required for exploitation
Configure Safe Reading Mode to prevent execution of high-risk actions from untrusted PDFs
Route PDF handling through a sandboxed or virtualized environment until patches are deployed
Use application allowlisting to prevent Foxit processes from launching command interpreters or unknown binaries

bash

# Example: silently deploy a Foxit update MSI on Windows via SCCM or PDQ
msiexec /i FoxitPDFEditor_Update.msi /qn REBOOT=ReallySuppress

# Example: verify installed Foxit version on Windows
reg query "HKLM\SOFTWARE\Foxit Software\Foxit PDF Editor" /v Version