ZDI-26-728: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
ZDI disclosed a Foxit PDF Reader Doc object use-after-free that can leak data if a user opens a malicious file.
24
CVE-2026-57238
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p7
- Published
- ·
- Modified
Description · NVD
After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news
2 storiesZDI-26-599: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
ZDI published advisory ZDI-26-599 for a use-after-free information disclosure flaw (CVE-2026-57238, CVSS 3.3) in Foxit PDF Reader requiring user interaction.
12