Foxit Patches 25+ PDF Flaws, Including Critical RCE Bugs

Foxit Software has rolled out a sweeping round of security updates for its PDF Reader and PDF Editor product lines, addressing more than two dozen vulnerabilities that span use-after-free flaws, out-of-bounds memory bugs, and a notable local privilege escalation issue in the application’s update mechanism.

The July 8, 2026 release covers Windows and macOS versions of both products, with patches extending as far back as the legacy 13.2.x and 14.x branches, which are still in active enterprise use.

Foxit Patches 25+ PDF Flaws

Given how deeply embedded Foxit’s tools are in document workflows across government, legal, and enterprise environments, this patch cycle deserves close attention from IT administrators managing fleet-wide deployments.

The bulk of the disclosed issues fall under CWE-416 (Use After Free), with more than a dozen CVEs including CVE-2026-13126 through CVE-2026-13129 and CVE-2026-57237 through CVE-2026-57256 sharing a common root cause.

Each occurs when the application interacts with PDFs embedded with malicious JavaScript, causing it to reference invalid or improperly initialized objects and pointers. All carry a CVSS score of 7.8 and are rated “Important,” with exploitation potentially enabling remote code execution or information disclosure.

Researchers from TrendAI Zero Day Initiative, independent researcher XuPeng, and Cisco Talos’s KPC were credited with discovering the bulk of these flaws, underscoring how JavaScript-enabled PDF rendering remains a persistent attack surface across the industry.

Perhaps the most operationally concerning finding is CVE-2026-57239, an Uncontrolled Search Path Element vulnerability (CWE-427) carrying a CVSS score of 8.2.

The flaw lies in Foxit’s own update-checking mechanism, which executes user-controllable executables with elevated privileges.

An attacker exploiting this could achieve DLL hijacking to obtain “NT AUTHORITY\SYSTEM” rights turning a routine update check into a full system compromise. Security researcher Luke Paris (@Paradoxis) is credited with the discovery.

Beyond the use-after-free cluster, Foxit patched several other memory-safety issues:

• Out-of-Bounds Read (CWE-125) bugs affecting page tree, image object, and color space parsing, rated Moderate with a 6.1 CVSS score
• Buffer Copy Without Checking Size of Input (CWE-120), tied to malformed signature fields and annotation objects, rated Important at 7.8
• Type Confusion (CWE-843) in Popup object handling after JavaScript destroys page annotations
• Out-of-Bounds Read/Write (CWE-787/125) tied to malformed PRC streams and Unity 3D objects when 3D content trust is enabled

An additional XML External Entity (XXE) vulnerability, CVE-2026-57259, affects XDP document parsing when files are disguised as standard PDFs, potentially exposing sensitive local data to remote attackers.

The patches cover Foxit PDF Reader and Editor 2026.1.1.36485 and earlier, along with legacy branches 2025.3.0, 2024.4.1, 2023.3.0, 14.0.4, and 13.2.4, meaning organizations running outdated deployments across multiple release cycles remain exposed until updated. Mac versions of both products received parallel fixes.

Foxit recommends users update via Help > Check for Update within the application, or download the latest installers directly from its product catalog. Given the scale of remote code execution risk across this release, security teams should prioritize patching endpoints that regularly handle externally sourced PDF files.

About the Author

Potheeswaran

Author

Visit Website View All Posts