When the application opens a PDF and executes JavaScript

CVE-2026-57256 is a use-after-free (CWE-416) in Foxit PDF Reader/Editor's JavaScript engine. When a crafted PDF's embedded JavaScript performs abnormal operations against a list box form field, and the form is subsequently reset, the freed object is reused — attackers who groom the heap correctly can pivot to arbitrary code execution in the context of the logged-in user. Affected builds are Foxit PDF Reader ≤ 2026.1.1.36485 and matching Foxit PDF Editor branches; fixed in Reader/Editor 2026.1.2 and Editor 14.0.5.

The vendor label of HIGH (7.8) is fair on paper — CVSS scores local execution with user interaction and full CIA impact. In practice this is a *client-side* browser-class RCE with a narrow trigger (JavaScript must run inside the PDF viewer and hit the reset-form path). It's real, but it is not a wormable server bug and there is no public exploitation. MEDIUM is the operational read for a fleet manager.

Why this verdict

• User interaction required (UI:R) — the chain does not start until the victim opens the file in Foxit. Every mail gateway, browser download warning, and Safe Reading Mode gate is an independent choke point.
• Local attack vector (AV:L) — no network-reachable service, no unauthenticated server surface. Attacker has to reach the desktop through a delivery channel that most enterprises already inspect.
• EPSS 0.00116, no KEV, no public PoC — real-world weaponization probability is low; this is a patch-cycle bug, not a fire drill.
• Blast radius = user token — no privilege escalation primitive, no domain identity theft, no fleet pivot. A compromised endpoint is bad but recoverable.
• Role multiplier: Foxit Reader/Editor is a desktop productivity tool. There is no realistic high-value-role deployment — it does not run on domain controllers, hypervisors, IdPs, CI runners, or edge appliances. The high-value-role floor does not apply.
• Market share friction: Foxit is a minority PDF viewer in most enterprises; Adobe, Edge, and Chrome cover the majority. Attacker must first ascertain the victim uses Foxit, which lowers targeting yield.

Why not higher?

HIGH would require either active exploitation, a network-reachable trigger, or a plausible high-value-role deployment. None apply — this is a client-side UAF gated by user interaction and JavaScript being enabled, with no KEV entry and negligible EPSS.

Why not lower?

LOW/IGNORE would ignore that this is a confirmed RCE primitive in a real enterprise-deployed product, not a theoretical crash. Client-side PDF UAFs are historically used by commercial spyware vendors (NSO, Intellexa) and access brokers; the vendor patch is genuine and the bug is real, so it earns a real remediation window.

1. Disable JavaScript in Foxit Reader/Editor by GPO — Kills the JavaScript execution prerequisite in step 2 of the chain. Push HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript = 0 via GPO or Intune. Deploy across the fleet — no mitigation SLA is enforced for MEDIUM, but this is a one-line change worth shipping within the current sprint.
2. Force Safe Reading Mode enabled and locked — Safe Reading Mode blocks unauthorized external actions and script triggers. Set SafeReadingMode = 1 and lock the preference so users cannot toggle it off.
3. Route PDF opens through the browser or Adobe Reader default — For orgs that don't require Foxit's editor features, changing the default .pdf handler to Microsoft Edge or Adobe Reader entirely sidesteps this CVE class. Use Set Default Programs GPO.
4. Tighten mail attachment policy — Have the SEG (Proofpoint/Mimecast/Defender for O365) sandbox or strip PDFs with embedded JavaScript. Most gateways offer a PDF with active content verdict — flip it to quarantine.
5. EDR rule: alert on Foxit spawning shells — Write a detection for FoxitPDFReader.exe / FoxitPDFEditor.exe spawning cmd.exe, powershell.exe, rundll32.exe, wscript.exe, mshta.exe. Trivial to write in CrowdStrike CQL / Defender AH; catches successful exploitation immediately.

Run on a Windows target host as a standard or admin user. Invoke with .\Check-Foxit-CVE-2026-57256.ps1. It inspects installed Foxit Reader/Editor versions from the registry and compares against the fixed builds.

#requires -Version 5.1
# Check-Foxit-CVE-2026-57256.ps1
# Reports VULNERABLE / PATCHED / UNKNOWN for CVE-2026-57256 (Foxit UAF).
# Fixed builds: Reader 2026.1.2, Editor 2026.1.2, Editor 14.0.5

$ErrorActionPreference = 'SilentlyContinue'
$vulnBuildMax = [Version]'2026.1.1.36485'
$fixedReader  = [Version]'2026.1.2.0'
$fixedEditor  = [Version]'2026.1.2.0'
$fixedEditor14= [Version]'14.0.5.0'

$paths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$found = @()
foreach ($p in $paths) {
    Get-ItemProperty $p 2>$null | Where-Object {
        $_.DisplayName -match 'Foxit\s+(PDF\s+)?(Reader|Editor|PhantomPDF)'
    } | ForEach-Object {
        $found += [PSCustomObject]@{
            Name    = $_.DisplayName
            Version = $_.DisplayVersion
        }
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN: Foxit not detected on this host.'
    exit 2
}

$verdict = 'PATCHED'
foreach ($f in $found) {
    try { $v = [Version]$f.Version } catch { $v = $null }
    if (-not $v) { Write-Output "UNKNOWN: $($f.Name) version $($f.Version) unparseable."; $verdict = 'UNKNOWN'; continue }

    $isReader = $f.Name -match 'Reader'
    $isEditor14 = ($f.Name -match 'Editor|PhantomPDF') -and $v.Major -eq 14
    $isEditor2026 = ($f.Name -match 'Editor|PhantomPDF') -and $v.Major -eq 2026

    $vuln = $false
    if ($isReader     -and $v -lt $fixedReader)   { $vuln = $true }
    if ($isEditor2026 -and $v -lt $fixedEditor)   { $vuln = $true }
    if ($isEditor14   -and $v -lt $fixedEditor14) { $vuln = $true }

    if ($vuln) {
        Write-Output "VULNERABLE: $($f.Name) $($f.Version)"
        $verdict = 'VULNERABLE'
    } else {
        Write-Output "PATCHED:    $($f.Name) $($f.Version)"
    }
}

switch ($verdict) {
    'VULNERABLE' { exit 1 }
    'PATCHED'    { exit 0 }
    default      { exit 2 }
}

Sources

1. Foxit Security Bulletins
2. GBHackers — Foxit Patches Multiple UAF Flaws Leading to RCE
3. CybersecurityNews — 20 RCE Vulnerabilities Patched in Foxit PDF Reader/Editor
4. Tenable Nessus plugin — Foxit PDF Reader < 2026.1.1 Multiple Vulnerabilities
5. Cyberpress — Foxit Patches PDF Reader Editor Vulnerabilities in 2026.1.2
6. CVE Details — Foxit PDF Reader vulnerabilities
7. OpenCVE — Foxit PDF Editor CVEs
8. THREATINT — CVE-2026-57256