Skip to content
OpenAdvisories
High · 7.8 CVE-2026-57240 EUVD-2026-42183GHSA-mvfx-5v77-ghpf

Foxit PDF Editor/Reader Form Field Use-After-Free Remote Code Execution Vulnerability

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by Foxit

Description

When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid pointer references and causing the application to crash.

Affected products

VendorProductAffectedFixed
Foxit Software Foxit PDF Editor Versions 2026.1.1 and earlier, Versions 14.0.4 and earlier, Versions 13.2.4 and earlier —
Foxit Software Foxit PDF Reader Versions 2026.1.1 and earlier —

Advisories 1

References