CVE-2026-57252: use-after-free in attachment panel

CISO Take

This is a use-after-free vulnerability in Foxit's PDF Reader/Editor: when embedded JavaScript deletes pages and removes attachment annotations, the attachment panel keeps referencing freed memory, crashing the application and — given the CVSS impact profile (C:H/I:H/A:H) — potentially allowing code execution rather than just a denial of service. This is a desktop document-viewer bug, not an AI/ML pipeline, model-serving, or agent-framework flaw, so it falls outside this platform's core AI threat surface; there is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, so opportunistic mass exploitation is unlikely today. The realistic risk is targeted: an attacker sends a crafted malicious PDF (phishing attachment) that a user must open and interact with (UI:R, AV:L), which is a well-worn initial-access vector regardless of AI relevance. Action: track Foxit's security bulletin for a patched build and apply it fleet-wide via standard desktop patch management; in the interim, treat unsolicited PDFs with embedded JavaScript and attachments as high-risk email/EDR detection signatures and consider disabling JavaScript execution in Foxit where feasible. No AI-specific mitigation or monitoring is warranted for this CVE.

Sources: NVD foxit.com

What is the risk?

Locally exploitable (AV:L), low attack complexity, no privileges required, but requires user interaction (opening a malicious PDF) — a classic phishing-delivered client-side memory-corruption bug. CVSS 7.8 (High) with full C/I/A impact reflects use-after-free severity, but absent EPSS data, KEV listing, public PoC, or scanner coverage, real-world exploitation likelihood is currently unproven/low. This is a generic desktop-software vulnerability, not an AI/ML system flaw — its relevance to AI threat intelligence tracking is minimal beyond general endpoint hygiene.

How does the attack unfold?

Delivery

Attacker delivers a crafted malicious PDF with embedded JavaScript via phishing email or download link.

User Interaction

Victim opens the PDF in Foxit Reader/Editor, triggering the embedded script to delete pages and remove attachment annotations.

Exploitation

The attachment panel continues accessing now-invalid pointers, triggering a use-after-free condition.

Impact

Application crashes (denial of service) or, depending on exploit development, memory corruption is leveraged for potential code execution on the endpoint.

Delivery

Attacker delivers a crafted malicious PDF with embedded JavaScript via phishing email or download link.

User Interaction

Victim opens the PDF in Foxit Reader/Editor, triggering the embedded script to delete pages and remove attachment annotations.

Exploitation

The attachment panel continues accessing now-invalid pointers, triggering a use-after-free condition.

Impact

Application crashes (denial of service) or, depending on exploit development, memory corruption is leveraged for potential code execution on the endpoint.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Monitor Foxit's official security bulletins (https://www.foxit.com/support/security-bulletins.html) for a patched release and deploy via standard endpoint patch management. 2) Where policy allows, disable JavaScript execution in Foxit Reader/Editor to eliminate the trigger path. 3) Treat inbound PDFs containing embedded JavaScript and attachment annotations as elevated-risk in email/attachment sandboxing and EDR detection rules. 4) No AI/ML-specific detection or compensating control is applicable — handle as standard endpoint software vulnerability management.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution DoS Plugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-57252?

This is a use-after-free vulnerability in Foxit's PDF Reader/Editor: when embedded JavaScript deletes pages and removes attachment annotations, the attachment panel keeps referencing freed memory, crashing the application and — given the CVSS impact profile (C:H/I:H/A:H) — potentially allowing code execution rather than just a denial of service. This is a desktop document-viewer bug, not an AI/ML pipeline, model-serving, or agent-framework flaw, so it falls outside this platform's core AI threat surface; there is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, so opportunistic mass exploitation is unlikely today. The realistic risk is targeted: an attacker sends a crafted malicious PDF (phishing attachment) that a user must open and interact with (UI:R, AV:L), which is a well-worn initial-access vector regardless of AI relevance. Action: track Foxit's security bulletin for a patched build and apply it fleet-wide via standard desktop patch management; in the interim, treat unsolicited PDFs with embedded JavaScript and attachments as high-risk email/EDR detection signatures and consider disabling JavaScript execution in Foxit where feasible. No AI-specific mitigation or monitoring is warranted for this CVE.

Is CVE-2026-57252 actively exploited?

No confirmed active exploitation of CVE-2026-57252 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57252?

1) Monitor Foxit's official security bulletins (https://www.foxit.com/support/security-bulletins.html) for a patched release and deploy via standard endpoint patch management. 2) Where policy allows, disable JavaScript execution in Foxit Reader/Editor to eliminate the trigger path. 3) Treat inbound PDFs containing embedded JavaScript and attachment annotations as elevated-risk in email/attachment sandboxing and EDR detection rules. 4) No AI/ML-specific detection or compensating control is applicable — handle as standard endpoint software vulnerability management.

What systems are affected by CVE-2026-57252?

This vulnerability affects the following AI/ML architecture patterns: Not applicable — this affects Foxit PDF Reader/Editor, a desktop document viewer, not an AI/ML pipeline, model-serving, RAG, or agent architecture.

What is the CVSS score for CVE-2026-57252?

CVE-2026-57252 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

Not applicable — this affects Foxit PDF Reader/Editor, a desktop document viewer, not an AI/ML pipeline, model-serving, RAG, or agent architecture

What are the technical details?

Original Advisory

When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel to continue accessing invalid pointers, eventually leading to the application crashing.

Exploitation Scenario

An attacker crafts a malicious PDF containing JavaScript that programmatically deletes pages and removes attachment annotations while the attachment panel is active, then delivers it via phishing email or a compromised download link. When the victim opens the PDF in Foxit and the script runs (requiring some user interaction, e.g., opening the file or triggering panel refresh), the attachment panel dereferences freed memory, crashing the application — or, with further exploit development against the same use-after-free, potentially achieving code execution on the victim's endpoint. This scenario has no dependency on any AI/ML component and would proceed identically on a non-AI workstation.

Weaknesses (CWE)

CWE-416 Use After Free CWE-416 Use After Free

CWE-416 — Use After Free: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

[Architecture and Design] Choose a language that provides automatic memory management.
[Implementation] When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE corpus.