CVE-2026-57241
Received Received - Intake

PDF JavaScript Out-of-Bounds Access in Renderer

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: Foxit

Description
The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-57241
EUVD
EUVD-2026-42180

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs when the application opens a PDF and executes JavaScript that manipulates the page and document. This causes the page-related objects within the application to lose synchronization. Despite this, the renderer continues to trust an outdated page count, which eventually leads to the application crashing due to out-of-bounds access.

Impact Analysis

The impact of this vulnerability is that the application may crash unexpectedly. This crash is caused by out-of-bounds access resulting from the renderer trusting outdated page information after JavaScript operations desynchronize page objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart