Foxit PDF Reader Vulnerable to Information Disclosure via Malicious File Parsing
A critical vulnerability in Foxit PDF Reader allows remote attackers to disclose sensitive information through specially crafted PDF files or malicious web pages.
A critical vulnerability, identified as ZDI-26-596 and assigned CVE-2026-57253, has been discovered in Foxit PDF Reader. This flaw permits remote attackers to gain unauthorized access to sensitive information residing on affected installations of the software. Exploitation of this vulnerability requires user interaction, meaning a victim must either open a malicious PDF file or visit a compromised webpage.
The root cause of the vulnerability lies within the PDF file parsing mechanism of Foxit PDF Reader. Specifically, the software fails to adequately validate user-supplied data, leading to an out-of-bounds read condition. This means the program attempts to access memory beyond the boundaries of an allocated object. While this specific vulnerability is categorized as an information disclosure flaw, it can be chained with other vulnerabilities to potentially achieve arbitrary code execution within the context of the current process.
This type of vulnerability, where improper handling of file parsing leads to memory corruption or out-of-bounds reads, is a common vector for attackers seeking to compromise software. By manipulating the structure of a PDF file, an attacker can trigger the flaw and potentially extract sensitive data that the application has access to. The low CVSS rating of 3.3 suggests that while critical, it might not be as easily exploitable for direct code execution without additional steps or other vulnerabilities.
Foxit has acknowledged the vulnerability and has released an update to address the issue. Users of Foxit PDF Reader are strongly advised to apply the available patch as soon as possible to mitigate the risk of exploitation. The company provides detailed security bulletins on its website, which include information on the affected versions and the patches released.
The vulnerability was initially reported to the vendor on April 30, 2026. Following a coordinated disclosure process, the advisory was publicly released on August 24, 2026, with an update to the advisory also occurring on the same day. The vulnerability was reported by an anonymous researcher.
While the immediate impact is information disclosure, the potential for chaining this vulnerability with others to achieve remote code execution highlights the importance of timely patching. Attackers often probe for such weaknesses to gain an initial foothold or gather intelligence before launching more sophisticated attacks. The reliance on user interaction means that social engineering tactics, such as phishing emails containing malicious links or attachments, could be employed to trick users into triggering the vulnerability.
This discovery underscores the ongoing challenges in securing complex software like PDF readers, which handle a wide variety of file formats and are frequent targets for malware. Developers must maintain rigorous validation and sanitization of all input data, especially when parsing external files, to prevent memory-related vulnerabilities.
Users should ensure their Foxit PDF Reader is updated to the latest version. Additionally, practicing safe browsing habits and being cautious about opening attachments from unknown sources can further reduce the risk of falling victim to such exploits.
The Zero Day Initiative advisory ZDI-26-600 specifically details a use-after-free vulnerability within Foxit PDF Reader's Annotation object handling. This vulnerability, tracked as CVE-2026-57237, allows for sensitive information disclosure and requires user interaction to exploit. While the existing story mentions the general category of information disclosure via malicious files or web pages, this new information provides the specific CVE, the precise vulnerability type (use-after-free), and the affected component (Annotation objects).
The Zero Day Initiative has disclosed a new use-after-free vulnerability in Foxit PDF Reader, identified as ZDI-26-603 and assigned CVE-2026-13127. This vulnerability, with a CVSS score of 7.8, allows for remote code execution when a user opens a malicious file or visits a compromised webpage, differing from the previously reported information disclosure flaw.
The Zero Day Initiative advisory ZDI-26-599 details a use-after-free vulnerability in Foxit PDF Reader's annotation handling, specifically CVE-2026-57238. While the existing story mentions information disclosure via crafted files or web pages, this new advisory specifies the vulnerability type as use-after-free and notes that exploitation requires user interaction, such as opening a malicious file or visiting a malicious webpage, to disclose sensitive information. The CVSS rating for this specific vulnerability is 3.3.
The Zero Day Initiative advisory ZDI-26-601 details a use-after-free vulnerability in Foxit PDF Reader, specifically impacting its Annotation handling. This new advisory assigns the CVE ID CVE-2026-13129 to the vulnerability, which has a CVSS score of 3.3 and requires user interaction for exploitation, such as opening a crafted file or visiting a malicious webpage.
The Zero Day Initiative has disclosed a new use-after-free vulnerability in Foxit PDF Reader, tracked as ZDI-26-602 and CVE-2026-13128. This vulnerability allows for remote code execution when a user interacts with a malicious file or webpage. While the previous advisory focused on information disclosure, this new finding details a distinct critical vulnerability that enables arbitrary code execution, carrying a CVSS score of 7.8.