VulnerabilityModified

CVE-2026-57256

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset.

HIGH 7.8EPSS 0.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.17% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-416
Affected: foxit/pdf editor · foxit/pdf reader
Source: 14984358-7092-470d-8f34-ade47a7658a2

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.