CVE-2026-57237

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

HIGH

7.8

CVSS Score

Published: July 8, 2026 at 07:36 AM UTC

Updated: July 9, 2026 at 02:45 PM UTC

2 products affected across 1 vendorPDF ReaderPDF Editor· also runs on 2 platforms

Using Foxit PDF Editor by Foxit Software Inc.?

Get instant alerts when new vulnerabilities affect Foxit PDF Editor - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

PDF Editor · Foxitsoftware

95%

v ≤ 13.2.3v ≤ 13.2.3.63444v ≤ 13.2.4v ≤ 13.2.4.24048v ≤ 14.0.3v ≤ 14.0.4v ≤ 2026.1.114.0.0.33046 ≤ v ≤ 14.0.3.6929514.0.0.33046 ≤ v ≤ 14.0.4.335082023.1.0.15510 ≤ v ≤ 2023.3.0.230282023.1.0.15510 ≤ v ≤ 2023.3.0.630832024.1.0.23997 ≤ v ≤ 2024.4.1.276872024.1.0.23997 ≤ v ≤ 2024.4.1.664792025.1.0.27937 ≤ v ≤ 2025.3.0.357372025.1.0.27937 ≤ v ≤ 2025.3.0.695702026.1.0.36452 ≤ v ≤ 2026.1.1.364852026.1.0.36452 ≤ v ≤ 2026.1.1.70276

apple-macos (environment) · microsoft-windows (environment)

PDF Reader · Foxitsoftware

95%

v ≤ 2026.1.1v ≤ 2026.1.1.36485v ≤ 2026.1.1.70276

apple-macos (environment) · microsoft-windows (environment)