CVE-2026-57259: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-57259 is an XML External Entity (XXE) injection vulnerability in Foxit PDF Editor and Foxit PDF Reader that allows an unauthenticated attacker to read arbitrary local files by tricking a user into opening a maliciously crafted document. The vulnerability was published on July 8, 2026, and affects Foxit PDF Editor across multiple version branches (up to 2026.1.1.36485, 14.0.4.33508, 13.2.4.24048, and earlier) as well as Foxit PDF Reader up to version 2026.1.1.36485. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Foxit Security Bulletins).

The root cause is CWE-611 (Improper Restriction of XML External Entity Reference): Foxit's PDF parsing pipeline accepts files that are not strictly valid PDFs, passing them to an XML parser after content inspection. A malicious document disguised as a PDF can embed crafted XML external entities that reference local file paths via protocol-based URIs (e.g., file://), causing the parser to resolve and return the contents of those files. Exploitation requires no privileges but does require user interaction — the victim must open the malicious file. No public proof-of-concept code has been identified at this time (GitHub Advisory, Foxit Security Bulletins).

Successful exploitation results in unauthorized read access to any local file accessible to the Foxit PDF Editor or Reader process, including sensitive configuration files, credentials, private keys, and other user-accessible data. The impact is limited to confidentiality — there is no integrity or availability impact. While lateral movement is not directly enabled, exfiltrated credentials or configuration data could facilitate further attacks (GitHub Advisory, Feedly).

1. Craft malicious document: Create a file that passes Foxit's initial PDF content check but is actually an XML document containing a malicious external entity declaration, e.g., <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///C:/Windows/win.ini">]> with a reference to &xxe; in the document body.
2. Disguise as PDF: Ensure the file has a .pdf extension and includes enough PDF-like header content to pass Foxit's initial format review before being forwarded to the XML parser.
3. Deliver to target: Send the malicious file to the victim via email attachment, download link, or other social engineering vector.
4. Victim opens file: When the victim opens the file in Foxit PDF Editor or Reader, the application passes it to the XML parser, which resolves the external entity and reads the referenced local file.
5. Exfiltrate data: If the application renders or logs the resolved entity content, the attacker can retrieve the file contents — potentially via an out-of-band channel (e.g., file:// or a UNC path pointing to an attacker-controlled server on Windows) (GitHub Advisory, Foxit Security Bulletins).

• File System: Unexpected .pdf files with XML DOCTYPE declarations or external entity references in their content; files with PDF headers but XML body structure.
• Network: Outbound SMB or HTTP requests from the Foxit process to external or attacker-controlled hosts (indicative of out-of-band XXE exfiltration via UNC paths or HTTP-based entity URIs).
• Process: Foxit PDF Editor or Reader process (FoxitPDFEditor.exe, FoxitPDFReader.exe) making unusual file read operations on sensitive system files (e.g., win.ini, hosts, credential stores) as observed via process monitoring tools.
• Logs: Application or system logs showing Foxit accessing files outside of normal document directories; Windows file audit logs recording reads of sensitive files by the Foxit process.

Foxit Software has released patched versions addressing this vulnerability; users should update Foxit PDF Editor and Foxit PDF Reader to the latest available versions beyond the affected ranges (2026.1.1, 14.0.4, and 13.2.4 and earlier). As a workaround, administrators should apply the principle of least privilege to the Foxit process to limit its file system access, and consider disabling external entity processing in XML parsers where configurable. Users should exercise caution when opening PDF files from untrusted sources (Foxit Security Bulletins, GitHub Advisory).

Security news outlets including CyberPress and UnderCodeNews covered the broader Foxit patch release, noting that over 30 vulnerabilities were addressed in the update batch that included CVE-2026-57259. Kaspersky's threat intelligence portal also catalogued the vulnerability. No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified (CyberPress, UnderCodeNews).