What’s Vulnerable › Vulnerabilities
CVE-2026-12057: DoS + Remote Code Execution via PDF JavaScript in Foxit AI
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-15 · updated 2026-10-25
- Weakness: CWE-829
Description
When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.
Affected products
- Foxit Software Inc. Foxit AI: before 2026-06-15 — fixed in 2026-06-15
How to fix
Upgrade to a fixed version: Foxit Software Inc. Foxit AI 2026-06-15. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12057 or the next vulnerability affects your stack