CVE-2026-57241
Analyzed Analyzed - Analysis Complete

PDF JavaScript Out-of-Bounds Access in Renderer

Publication date: 2026-07-08

Last updated on: 2026-07-09

Assigner: Foxit

Description
The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-09
Generated
2026-07-15
AI Q&A
2026-07-08
EPSS Evaluated
2026-07-14
NVD
CVE-2026-57241
EUVD
EUVD-2026-42180

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
foxit pdf_editor From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit pdf_editor From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit pdf_editor From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit pdf_editor From 2026.1.0.36452 (inc) to 2026.1.1.36485 (inc)
foxit pdf_reader to 2026.1.1.36485 (inc)
foxit pdf_editor to 13.2.4.24048 (inc)
foxit pdf_editor From 14.0.0.33046 (inc) to 14.0.4.33508 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs when the application opens a PDF and executes JavaScript that manipulates the page and document. This causes the page-related objects within the application to lose synchronization. Despite this, the renderer continues to trust an outdated page count, which eventually leads to the application crashing due to out-of-bounds access.

Impact Analysis

The impact of this vulnerability is that the application may crash unexpectedly. This crash is caused by out-of-bounds access resulting from the renderer trusting outdated page information after JavaScript operations desynchronize page objects.

Mitigation Strategies

To mitigate this vulnerability, users are advised to update their Foxit PDF Reader and Editor applications to the latest versions.

  • Use the application’s built-in update feature to obtain the latest version.
  • Alternatively, download the latest versions directly from the Foxit website.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart