CVE-2026-57252: Foxit PDF Editor Use-After-Free Flaw

CVE-2026-57252 Overview

CVE-2026-57252 is a use-after-free vulnerability [CWE-416] affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. The flaw occurs when a PDF file uses JavaScript to delete pages and remove attachment annotations. During this sequence, the attachment panel continues to access pointers that have already been freed, leading to memory corruption and application crash.

An attacker can craft a malicious PDF that triggers the condition when opened by a local user. Successful exploitation may result in denial of service or arbitrary code execution in the context of the current user.

Critical Impact
Opening a crafted PDF triggers a use-after-free in the attachment panel, enabling potential local code execution with high confidentiality, integrity, and availability impact.

Affected Products

Foxit PDF Editor on Microsoft Windows
Foxit PDF Reader on Microsoft Windows
Microsoft Windows (host operating system)

Discovery Timeline

2026-07-08 - CVE-2026-57252 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57252

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the attachment panel component of Foxit PDF Editor and Foxit PDF Reader. When a PDF document executes JavaScript that deletes pages and removes attachment annotations, the underlying attachment objects are freed. The attachment panel user interface, however, retains references to those freed objects and continues to dereference them.

Accessing freed memory can corrupt the heap state, trigger an access violation, or allow an attacker to influence the contents of the reclaimed allocation. If the freed region is reallocated with attacker-controlled data before the dangling reference is used, arbitrary code execution in the process context becomes possible.

Root Cause

The root cause is a lifetime management flaw between the PDF document model and the attachment panel view. The panel does not synchronize with object deletions performed by embedded JavaScript. Removing attachment annotations invalidates internal pointers, but the panel neither clears nor validates them before subsequent access.

Attack Vector

Exploitation requires local access and user interaction. The victim must open a specially crafted PDF file in a vulnerable version of Foxit PDF Editor or Foxit PDF Reader. The malicious document leverages the JavaScript engine to delete pages and attachment annotations, forcing the attachment panel to dereference freed memory.

The vulnerability is described in the vendor advisory. See the Foxit Security Bulletins for technical details specific to this issue.

Detection Methods for CVE-2026-57252

Indicators of Compromise

Unexpected crashes of FoxitPDFEditor.exe or FoxitPDFReader.exe shortly after opening a PDF from email, chat, or web downloads.
Windows Error Reporting (WER) entries referencing access violations in the attachment panel or JavaScript engine modules of Foxit products.
PDF files that contain embedded JavaScript invoking page deletion together with attachment annotation removal.

Detection Strategies

Inspect PDF content for JavaScript actions calling deletePages in combination with attachment or FileAttachment annotation manipulation.
Monitor for child processes spawned by Foxit executables that are inconsistent with normal document workflows.
Correlate PDF opens with subsequent process crashes and heap corruption exceptions on the same endpoint.

Monitoring Recommendations

Ingest process, file, and crash telemetry from Windows endpoints into a centralized platform for behavioral analytics.
Alert on Foxit process termination with exception codes 0xC0000005 (access violation) or 0xC0000374 (heap corruption).
Track PDF files sourced from external senders and flag documents containing JavaScript that modifies annotations at runtime.

How to Mitigate CVE-2026-57252

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader on all Windows systems to the latest version published in the vendor advisory.
Restrict opening of PDF files received from untrusted senders until patches are deployed.
Disable JavaScript execution inside Foxit products across managed endpoints as a temporary containment measure.

Patch Information

Foxit has addressed this issue through its security bulletin process. Refer to the Foxit Security Bulletins page for the fixed version numbers and download locations for Foxit PDF Editor and Foxit PDF Reader on Windows.

Workarounds

Turn off JavaScript in Foxit PDF Editor and Reader via Preferences > JavaScript > Enable JavaScript Actions (uncheck).
Enable Safe Reading Mode to block execution of unverified actions inside PDF documents.
Use email gateway and web proxy rules to strip or quarantine PDF attachments containing embedded JavaScript from external sources.

bash

# Configuration example: disable JavaScript in Foxit via Windows registry (per-user)
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript"  /v bJSEnable /t REG_DWORD /d 0 /f