CVE-2026-57256: Foxit PDF Editor DOS Vulnerability

CVE-2026-57256 Overview

CVE-2026-57256 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. The flaw occurs when the application opens a crafted PDF and executes embedded JavaScript that performs abnormal operations on a list box form field. When the form is reset, the operation repeats and the application accesses internal members of invalid or improperly initialized field objects. The result is an illegal pointer read that crashes the application and, under the right conditions, can be steered toward code execution.

Critical Impact
A local attacker who convinces a user to open a malicious PDF can trigger memory corruption in the Foxit process, leading to application crash or arbitrary code execution in the context of the current user.

Affected Products

Foxit PDF Editor on Microsoft Windows and Apple macOS
Foxit PDF Reader on Microsoft Windows and Apple macOS
PDF workflows that permit execution of embedded JavaScript

Discovery Timeline

2026-07-08 - CVE-2026-57256 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57256

Vulnerability Analysis

The vulnerability resides in the form field handling logic that manages list box widgets inside Foxit PDF Editor and Reader. When JavaScript embedded in a PDF invokes abnormal operations against a list box field, the underlying form object and its dictionary pointers enter an inconsistent state. A subsequent form reset re-runs the same code path against the now-invalid field structure. Because the application does not adequately validate the form object or its internal dictionary pointer before dereferencing it, the process reads from freed or uninitialized memory. This condition maps to Use-After-Free [CWE-416] and manifests as an illegal pointer read that crashes the reader. Attackers who groom the freed allocation with attacker-controlled data can convert the read primitive into information disclosure or use it as a stepping stone toward arbitrary code execution within the PDF application process.

Root Cause

The root cause is missing validation of form field objects and their embedded dictionary pointers along the reset path. The code trusts that a field reference remains valid across script-driven mutations and a subsequent reset, but the earlier abnormal JavaScript operation leaves the field object partially destroyed. When the reset handler dereferences internal members of that stale field, it reads memory that no longer belongs to a valid object.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted PDF through email, a web download, a shared drive, or a messaging channel. When the victim opens the document in a vulnerable Foxit build with JavaScript enabled, the embedded script exercises the list box field and then invokes a form reset. This drives the vulnerable code path and triggers the illegal pointer read. The vulnerability affects confidentiality, integrity, and availability of the user session running the Foxit process.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability at publication is 0.116%.

Detection Methods for CVE-2026-57256

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after a user opens a PDF, with faulting module pointing to form or JavaScript components.
Windows Error Reporting (WER) or macOS crash logs referencing access violation reads in field or AcroForm-related routines.
PDF files containing JavaScript that calls resetForm() in combination with list box field mutations from untrusted sources.

Detection Strategies

Inspect inbound PDFs at the mail and web gateways for embedded JavaScript that manipulates list box fields and issues form resets.
Correlate endpoint process crash telemetry with the parent process being Foxit, focusing on repeated crashes across multiple users receiving the same attachment.
Hunt for anomalous child processes spawned by Foxit binaries, which would indicate exploitation beyond a simple crash.

Monitoring Recommendations

Enable and forward application crash and exception telemetry from Windows and macOS endpoints to a central data lake for retrospective analysis.
Alert on Foxit processes performing outbound network connections or writing to autorun locations, both of which are atypical for a PDF viewer.
Track Foxit version inventory across the fleet so unpatched hosts are visible to the security team.

How to Mitigate CVE-2026-57256

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the fixed builds referenced in the vendor security bulletin as soon as they are available in your environment.
Disable JavaScript execution in Foxit PDF applications until patching is complete, using Preferences > JavaScript > Enable JavaScript Actions set to off.
Restrict opening of PDFs from untrusted sources and route inbound PDFs through a content disarm and reconstruction (CDR) or sandbox layer.

Patch Information

Foxit publishes fixed builds and remediation details through the Foxit Security Bulletins. Administrators should identify the advisory that references CVE-2026-57256, apply the corresponding version on both Windows and macOS endpoints, and confirm the update through the Foxit About dialog or software inventory tooling.

Workarounds

Turn off JavaScript in Foxit PDF Editor and Reader to block the JavaScript-driven trigger path against the list box field.
Configure the Foxit Trust Manager to run PDFs in Safe Reading Mode and block execution of privileged JavaScript APIs.
Use application allowlisting or Attack Surface Reduction rules to prevent Foxit processes from spawning child processes such as cmd.exe or powershell.exe.

bash

# Windows: disable Foxit JavaScript via registry (adjust hive and version key for your build)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f