ZDI-26-597: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57252, CVSS 7.8) allowing remote code execution via malicious AcroForm content.
ZDI-26-597 describes a use-after-free vulnerability in the AcroForm feature of Foxit PDF Reader, tracked as CVE-2026-57252 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
- Use-after-free in AcroForm processing enables arbitrary remote code execution
- CVSS 7.8; user interaction is required for exploitation
- CVE-2026-57252; no in-the-wild exploitation reported
- CVEs
- CVE-2026-57252
- Vendors
- Foxit
- Products
- Foxit PDF Reader
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-57252 | When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel… | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.