CVE-2026-57238: Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Published Jul 8, 2026
·Updated
After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
Affected Software
9 affected components
Foxit Foxit PDF Editor/Reader
All of the following
Any of the following
Foxit PDF Editor<=13.2.4.24048
Foxit PDF Editor>=14.0.0.33046<=14.0.4.33508
Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028
Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687
Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737
Foxit PDF Editor>=2026.1.0.36452<=2026.1.1.36485
Foxit PDF Reader<=2026.1.1.36485
Microsoft Windows
Event History
Jul 8, 2026
CVE Published
via MITRE·07:36 AM
Data Sourced
via MITRE·07:36 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-57238?
CVE-2026-57238 has a severity rating of high with a score of 7.8.
2
What type of vulnerability is CVE-2026-57238?
CVE-2026-57238 is categorized as a Use After Free vulnerability.
3
How do I fix CVE-2026-57238?
To remediate CVE-2026-57238, ensure that you are using the latest version of Foxit PDF Editor/Reader.
4
What can exploit CVE-2026-57238?
CVE-2026-57238 can be exploited via malicious PDF files that contain JavaScript designed to trigger the use-after-free condition.
5
What are the potential impacts of CVE-2026-57238?
Exploitation of CVE-2026-57238 can lead to remote code execution, allowing attackers to crash the application or execute arbitrary code.