CVE-2026-57255: CWE-125 Out-of-bounds read in Foxit Software Inc. Foxit PDF Editor
The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application.
AI Analysis
Technical Summary
This vulnerability (CWE-125) in Foxit PDF Editor arises from improper validation of a function referenced by an abnormal color space attribute in a PDF file. When the function's output is read, it can produce an illegal pointer that accesses memory outside the intended bounds, resulting in an application crash. The CVSS 3.1 base score is 6.1, reflecting local attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.
Potential Impact
Successful exploitation causes an out-of-bounds read that crashes the Foxit PDF Editor application, leading to a denial of service. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Users should avoid opening untrusted PDF files containing abnormal color spaces until a fix is released.
CVE-2026-57255: CWE-125 Out-of-bounds read in Foxit Software Inc. Foxit PDF Editor
Description
The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application.
CVSS v3.1
Score 6.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-125) in Foxit PDF Editor arises from improper validation of a function referenced by an abnormal color space attribute in a PDF file. When the function's output is read, it can produce an illegal pointer that accesses memory outside the intended bounds, resulting in an application crash. The CVSS 3.1 base score is 6.1, reflecting local attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.
Potential Impact
Successful exploitation causes an out-of-bounds read that crashes the Foxit PDF Editor application, leading to a denial of service. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Users should avoid opening untrusted PDF files containing abnormal color spaces until a fix is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Foxit
- Date Reserved
- 2026-06-24T03:01:18.718Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4e27edc9d9e3dbe3eaebe3
Added to database: 07/08/2026, 10:35:25 UTC
Last enriched: 07/15/2026, 12:18:44 UTC
Last updated: 08/22/2026, 10:52:10 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.