ZDI-26-597: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57252, CVSS 7.8) allowing remote code execution via malicious AcroForm content.
ZDI-26-597 describes a use-after-free vulnerability in the AcroForm feature of Foxit PDF Reader, tracked as CVE-2026-57252 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
- Use-after-free in AcroForm processing enables arbitrary remote code execution
- CVSS 7.8; user interaction is required for exploitation
- CVE-2026-57252; no in-the-wild exploitation reported
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-57252 | When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel t When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel to continue accessing invalid pointers, eventually leading to the application crashing. NVD description · AI analysis pending | 7.8 | <1% |
| — |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-57252.
This source does not provide full text. Read it at zerodayinitiative.com.