CVE-2026-57256: RCE via JavaScript in Foxit PDF Reader

The use of V8 JavaScript in PDF rendering engines and editors enables the creation of dynamic documents that can change depending on user input or events. Cisco Talos discovered a use-after-free vulnerability when processing interactive PDF forms in Foxit PDF Reader 2026.1.1.36485. The vulnerability, tracked as CVE-2026-57256, received a CVSS 7.8 rating and allows arbitrary code execution after opening a specially crafted PDF file. The error occurs when JavaScript interacts with form fields. The event handler calls deletePages(), which deletes a page and frees the objects associated with it. After the callback returns, Foxit continues accessing an already freed array object. Depending on the objects' locations in memory, the UAF can be turned into arbitrary read and write operations, followed by code execution with the privileges of the user running Foxit. The attack requires no privileges, but the victim must open a malicious document. Foxit fixed the issue in PDF Reader/Editor 2026.1.2, as well as in Editor 14.0.5 and 13.2.5. The updates were released on July 8, 2026. Article: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2420