ZDI-26-595: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57254, CVSS 7.8) allowing remote code execution when a user opens a malicious file or page.
30
CVE-2026-57254
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p7
- Published
- ·
- Modified
Description · NVD
There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-843
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H