PT-2026-56355 · Foxit · Foxit Reader+1

Published 2026-07-08 · Updated 2026-07-09 · CVE-2026-57256

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit Editor/Reader (affected versions not specified)

Description When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, which are repeated after the form is reset. The application fails to adequately verify the validity of form objects and their internal dictionary pointers, leading to the access of internal members of invalid or improperly initialized fields. This results in an illegal pointer read, causing the application to crash. This is a Use-After-Free issue, which occurs when a program continues to use a pointer after it has been freed, potentially leading to crashes or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-57256

Affected Products

Foxit Editor

Foxit Reader

References · 7

• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-57256 · Security Note
• https://t.me/cveNotify/193268 · Telegram Post
• https://t.me/cveNotify/190929 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2420 · Note
• https://t.me/CVEtracker/59356 · Telegram Post
• https://t.me/cveNotify/194146 · Telegram Post