Out-of-bounds read in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-57258
Published: July 8, 2026
Vulnerability identifier: #VU137076
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-57258
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor when opening certain PDFs containing an abnormal Unity 3D object. A remote attacker can trick the victim into opening a crafted PDF file to disclose sensitive information.
3D content trust must be enabled.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
How to mitigate CVE-2026-57258
Install security update from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.5.24109, 14.0.5.33580, 2026.1.2.36540, 2026.1.2.70304
Foxit PDF Reader for Windows - update to 2026.1.2.36540
Foxit PDF Reader for Windows - update to 2026.1.2.36540