CVE-2026-57256: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-57256 is a use-after-free (UAF) vulnerability in Foxit PDF Reader and Foxit PDF Editor that can lead to remote code execution when a victim opens a specially crafted malicious PDF file. The flaw was discovered by KPC of Cisco Talos, disclosed to the vendor on 2026-05-11, and publicly released on 2026-07-08. Affected products include Foxit PDF Reader up to version 2026.1.1.36485, Foxit PDF Editor versions 2023.x through 2026.1.1.36485, 13.x up to 13.2.4.24048, and 14.x up to 14.0.4.33508. It carries a CVSS v3.1 base score of 7.8 (High) (Talos, GitHub Advisory).

The vulnerability is classified as CWE-416 (Use After Free) and resides in the JavaScript CBF_Widget checkbox/list box handling logic within Foxit PDF Reader's V8-based JavaScript engine. When a PDF executes JavaScript that performs operations on a list box field (e.g., setItems()), resets the form, and then triggers a callback (such as deletePages()) via a Format event action, the application frees the array object associated with the page but subsequently dereferences it without validation. Specifically, deletePages() calls HeapFree on the vulnerable object, and a later access at the freed memory address causes an access violation (code c0000005). Cisco Talos published a detailed proof-of-concept demonstrating the trigger sequence using getField, resetForm, setAction, and deletePages JavaScript API calls (Talos, GitHub Advisory).

Successful exploitation can result in arbitrary code execution in the context of the current user, with high confidentiality, integrity, and availability impact. Depending on the memory layout of the process at the time of exploitation, an attacker may be able to perform arbitrary read and write operations beyond a simple crash, potentially enabling full system compromise. The attack requires local access and user interaction (opening a malicious PDF), limiting its scope, but the high CIA impact makes it a significant risk for organizations relying on Foxit products for document workflows (Talos, GitHub Advisory).

1. Craft malicious PDF: Create a PDF document containing embedded JavaScript that defines a main() function and a delete_pages() callback. The JavaScript uses app.activeDocs[0].getField('List Box0').setItems([true]) to manipulate a list box field, calls app.activeDocs[0].resetForm(), assigns a Format event action via getField("List Box0").setAction("Format", 'delete_pages();'), and then calls setItems([true]) again to trigger the Format event.
2. Trigger the callback: When the Format event fires, delete_pages() is invoked, which calls app.activeDocs[0].deletePages(), freeing all objects associated with the page — including the array object previously referenced by the list box field.
3. Exploit use-after-free: After HeapFree releases the vulnerable object, the application continues to dereference the now-freed pointer without validation, causing an access violation at the freed memory address.
4. Achieve code execution: Depending on heap layout, an attacker can potentially reclaim the freed memory with attacker-controlled data, enabling arbitrary read/write operations and ultimately remote code execution in the context of the Foxit process.
5. Deliver payload: Distribute the malicious PDF via phishing email, malicious download link, or other social engineering vectors to induce the victim to open it with a vulnerable version of Foxit PDF Reader or Editor (Talos).

• Process: Foxit PDF Reader or Editor process (FoxitPDFReader.exe) crashing with access violation (exception code c0000005) when opening a PDF; unexpected child processes spawned by the Foxit process (e.g., cmd.exe, powershell.exe).
• Logs: Windows Event Log entries showing application crash for FoxitPDFReader.exe or FoxitPDFEditor.exe; crash dump files (.dmp) generated in %LOCALAPPDATA%\CrashDumps or the Foxit installation directory.
• File System: Unexpected PDF files received via email or downloaded from untrusted sources; presence of crash dump files referencing FoxitPDFReader!safe_vsnprintf in stack traces.
• Network: Outbound connections from the Foxit process to unexpected external IP addresses or domains following PDF opening, which may indicate post-exploitation activity (Talos).

Foxit has released patched versions addressing this vulnerability: Foxit PDF Reader 2026.1.2 and Foxit PDF Editor 2026.1.2 / 14.0.5 / 13.2.5. Users should update immediately via the Foxit website or built-in updater. As interim mitigations, restrict opening PDF files from untrusted sources and consider disabling JavaScript execution in PDF documents within Foxit's preferences if operational requirements allow (Talos, Foxit Security Bulletins).

Cisco Talos credited researcher KPC for discovering and reporting the vulnerability, and published a detailed technical write-up including debugger output and a proof-of-concept JavaScript payload (Talos). Security news outlets including CyberPress, GBHackers, CyberSecurityNews, and HealSecurity covered the broader Foxit patch release, noting that over 20–30 vulnerabilities were addressed in the same update cycle (GBHackers, CyberSecurityNews). The CISA vulnerability bulletin (SB26-194) also referenced the CVE as part of its weekly summary (CISA Bulletin).