CVE-2026-57253 Details
Description
An abnormal image object causes the renderer to enter the wrong processing branch. When converting the scan lines, an invalid image buffer pointer is used, resulting in the application crashing.
A vulnerability exists in Foxit PDF Reader and Foxit PDF Editor for Windows and Mac, specifically in versions prior to 2026.1.2. This vulnerability involves improper handling of certain PDFs with abnormal page trees, image objects, or color spaces. The issue causes the application to crash and could be exploited to disclose information. The root cause lies in the application's failure to validate page information after executing JavaScript, leading to the incorrect processing of malformed image buffers and unvalidated outputs from flawed color space functions.
Users can update to Foxit PDF Reader or Foxit PDF Editor version 2026.1.2. For Foxit PDF Editor for Mac, version 2026.1.2/14.0.5 is available. Instructions for updating or downloading the latest versions are provided on the Foxit website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.foxit.com/support/security-bulletins.html | Foxit | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | Foxit |
Affected Products
| Product | Versions |
|---|---|
| foxit pdf editor | <= 13.2.4.24048 >= 14.0.0.33046, <= 14.0.4.33508 >= 2023.1.0.15510, <= 2023.3.0.23028 >= 2024.1.0.23997, <= 2024.4.1.27687 >= 2025.1.0.27937, <= 2025.3.0.35737 >= 2026.1.0.36452, <= 2026.1.1.36485 |
CPE
Remediation
| |
| foxit pdf reader | <= 2026.1.1.36485 |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | Foxit |