CVE-2026-57260

Security vulnerability in Foxit PDF Editor/Reader — U3D Adobe Mesh Decompression (Type Confusion / Invalid Pointer Dereference)

HIGH

7.8

CVSS Score

Published: July 8, 2026 at 07:35 AM UTC

Updated: July 9, 2026 at 11:45 AM UTC

2 products affected across 1 vendorPDF ReaderPDF Editor· also runs on 2 platforms

Using Foxit PDF Editor by Foxit Software Inc.?

Get instant alerts when new vulnerabilities affect Foxit PDF Editor - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

PDF Editor · Foxitsoftware

95%

v ≤ 13.2.3v ≤ 13.2.3.63444v ≤ 13.2.4v ≤ 13.2.4.24048v ≤ 14.0.3v ≤ 14.0.4v ≤ 2026.1.114.0.0.33046 ≤ v ≤ 14.0.4.3350814.0.0.68868 ≤ v ≤ 14.0.3.692952023.1.0.15510 ≤ v ≤ 2023.3.0.230282023.1.0.55583 ≤ v ≤ 2023.3.0.630832024.1.0.23997 ≤ v ≤ 2024.4.1.276872024.1.0.63682 ≤ v ≤ 2024.4.1.664792025.1.0.27937 ≤ v ≤ 2025.3.0.357372025.1.0.66692 ≤ v ≤ 2025.3.0.695702026.1.0.36452 ≤ v ≤ 2026.1.1.364852026.1.0.70169 ≤ v ≤ 2026.1.1.70276

apple-macos (environment) · microsoft-windows (environment)

PDF Reader · Foxitsoftware

95%

v ≤ 2026.1.1v ≤ 2026.1.1.36485v ≤ 2026.1.1.70276

apple-macos (environment) · microsoft-windows (environment)