CVE-2026-57250

Foxit PDF Editor/Reader Form Field Use-After-Free Vulnerability

HIGH

7.8

CVSS Score

Published: July 8, 2026 at 07:36 AM UTC

Updated: July 9, 2026 at 01:25 PM UTC

2 products affected across 1 vendorPDF ReaderPDF Editor· also runs on 2 platforms

Using Foxit PDF Editor by Foxit Software Inc.?

Get instant alerts when new vulnerabilities affect Foxit PDF Editor - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is damaged, but the application does not perform validation. The function call on the damaged object leads to the application crashing.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

PDF Editor · Foxitsoftware

95%

v ≤ 13.2.3v ≤ 13.2.3.63444v ≤ 13.2.4v ≤ 13.2.4.24048v ≤ 14.0.3v ≤ 14.0.4v ≤ 2026.1.114.0.0.33046 ≤ v ≤ 14.0.4.3350814.0.0.68868 ≤ v ≤ 14.0.3.692952023.1.0.15510 ≤ v ≤ 2023.3.0.230282023.1.0.55583 ≤ v ≤ 2023.3.0.630832024.1.0.23997 ≤ v ≤ 2024.4.1.276872024.1.0.63682 ≤ v ≤ 2024.4.1.664792025.1.0.27937 ≤ v ≤ 2025.3.0.357372025.1.0.66692 ≤ v ≤ 2025.3.0.695702026.1.0.36452 ≤ v ≤ 2026.1.1.364852026.1.0.70169 ≤ v ≤ 2026.1.1.70276

apple-macos (environment) · microsoft-windows (environment)

PDF Reader · Foxitsoftware

95%

v ≤ 2026.1.1v ≤ 2026.1.1.36485v ≤ 2026.1.1.70276

apple-macos (environment) · microsoft-windows (environment)