CVE-2026-57252: Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Published Jul 8, 2026
·Updated
When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel to continue accessing invalid pointers, eventually leading to the application crashing.
Affected Software
9 affected components
Foxit PDF Editor/Reader
All of the following
Any of the following
Foxit PDF Editor<=13.2.4.24048
Foxit PDF Editor>=14.0.0.33046<=14.0.4.33508
Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028
Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687
Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737
Foxit PDF Editor>=2026.1.0.36452<=2026.1.1.36485
Foxit PDF Reader<=2026.1.1.36485
Microsoft Windows
Event History
Jul 8, 2026
CVE Published
via MITRE·07:36 AM
Data Sourced
via MITRE·07:36 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-57252?
The severity of CVE-2026-57252 is rated high, with a score of 7.8.
2
What type of vulnerability is CVE-2026-57252?
CVE-2026-57252 is a Use-After-Free vulnerability that can lead to remote code execution.
3
What applications are affected by CVE-2026-57252?
CVE-2026-57252 affects Foxit PDF Editor, Foxit PDF Editor/Reader, and Foxit PDF Reader.
4
How do I fix CVE-2026-57252?
To fix CVE-2026-57252, ensure you update to the latest version of the affected Foxit PDF products.
5
What can happen if I don't address CVE-2026-57252?
If left unaddressed, CVE-2026-57252 could lead to application crashes and potential remote code execution.