CVE-2026-57242 Details
Description
The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash.
A use-after-free vulnerability has been identified in multiple Foxit products, including Foxit PDF Reader and Foxit PDF Editor, all on Windows. This vulnerability allows for arbitrary code execution and arises when the application processes PDFs containing specific JavaScript. The issue occurs because the application fails to properly manage the lifecycle of related objects, leading to the dereferencing of invalid objects and eventually causing a crash. Exploitation of this vulnerability could be achieved by embedding malicious JavaScript into a PDF, which, when opened with the affected Foxit application, could trigger the use-after-free condition and execute arbitrary code.
Users can update to Foxit PDF Reader or Foxit PDF Editor versions 2026.1.2, 14.0.5, or 13.2.5. Foxit PDF Editor for Mac users should update to version 2026.1.2 or 14.0.5. For more information, contact the Foxit Security Response Team.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.foxit.com/support/security-bulletins.html | Foxit | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | Foxit |
Affected Products
| Product | Versions |
|---|---|
| foxit pdf editor | <= 13.2.4.24048 >= 14.0.0.33046, <= 14.0.4.33508 >= 2023.1.0.15510, <= 2023.3.0.23028 >= 2024.1.0.23997, <= 2024.4.1.27687 >= 2025.1.0.27937, <= 2025.3.0.35737 >= 2026.1.0.36452, <= 2026.1.1.36485 |
CPE
Remediation
| |
| foxit pdf reader | <= 2026.1.1.36485 |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | Foxit |