CVE-2026-57256: RCE via JavaScript in Foxit PDF Reader The use of V8 JavaScript in PDF rendering engines and editors enables the creation of dynamic documents that can change depending on user input or events. Cisco Talos discovered a use-after-free vulnerability when processing interactive PDF forms in Foxit PDF Reader 2026.1.1.36485. The vulnerability, tracked as CVE-2026-57256 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-57256), received a CVSS 7.8 rating and allows arbitrary code execution after opening a specially crafted PDF file. The error occurs when JavaScript interacts with form fields. The event handler calls "deletePages()", which deletes a page and frees the objects associated with it. After the callback returns, Foxit continues accessing an already freed array object. Depending on the objects' locations in memory, the UAF can be turned into arbitrary read and write operations, followed by code execution with the privileges of the user running Foxit. The attack requires no privileges, but the victim must open a malicious document. Foxit fixed the issue in PDF Reader/Editor 2026.1.2, as well as in Editor 14.0.5 and 13.2.5. The updates were released on July 8, 2026. Article: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2420 #dbugs_attacks
Post summary
Cisco Talos identified a use‑after‑free RCE in Foxit PDF Reader (CVE‑2026‑57256); the vulnerability is patched in the July 8, 2026 update, and no active exploitation has been reported.