Foxit PDF Reader CVE-2026-12057: Brief Summary of JavaScript Sandbox Bypass Leading to Arbitrary Code Execution

Introduction

A JavaScript sandbox bypass in Foxit PDF products lets attackers load remote scripts and achieve arbitrary code execution simply by convincing a user to open a crafted PDF file. The vulnerability has a CVSS score of 8.6, and Foxit claims an installed base of over 700 million users across 485,000 customer organizations. That makes it a meaningful risk for enterprises that use Foxit as their primary PDF solution.

Foxit Software, founded in 1996 and headquartered in Fremont, California, develops tools for viewing, editing, signing, and printing PDF documents. The company is widely regarded as the leading alternative to Adobe Acrobat and is commonly deployed across enterprise environments via MSI packages. G2 named Foxit one of the best software companies in its 2025 Best Software Awards, and the company has a significant presence in both the SMB and global enterprise markets.

CVE-2026-12057 was published on June 15, 2026. As of that date, no official patch version has been confirmed, the NVD has not published a full CVSS vector, and no specific affected version ranges have been disclosed.

Technical Information

Root Cause: CWE-829 and the Blocklist Problem

CVE-2026-12057 is classified under CWE-829: Inclusion of Functionality from Untrusted Control Sphere. This weakness occurs when a product imports or includes executable functionality from a source outside its intended control sphere without sufficient protection. Foxit's PDF rendering engine includes a JavaScript execution environment (sandbox) that processes scripts embedded in PDF files. The sandbox is designed to intercept dangerous API calls and stop untrusted code from interacting with the underlying operating system. It fails to intercept some dangerous interfaces, though, and those gaps allow remote scripts to load and ultimately enable arbitrary code execution.

The core architectural issue is that Foxit's sandbox appears to operate on a blocklist model. Specific known dangerous interfaces are blocked one by one, and everything else is permitted. The mitigation CWE-829 recommends is the opposite, an allowlist, where only explicitly approved function calls are permitted inside the sandbox. Under a blocklist, any newly discovered dangerous interface that is not on the list can be used to bypass the sandbox.

Historical Dangerous Interfaces in Foxit's JavaScript API

Research into prior Foxit sandbox bypasses has documented several JavaScript API functions exploited in similar attacks:

• app.launchURL: Opens URLs, potentially including local file protocol handlers
• xfa.host.gotoURL: Shown to execute local programs such as cmd.exe through the file:/// protocol handler. It was historically not protected by Trust Manager or Safe Reading Mode
• this.saveAs: Used to drop malicious files (such as .hta HTML applications) onto the local file system
• xfa.host.exportData: Also used to write files to disk

The specific interfaces exploited in CVE-2026-12057 have not been publicly disclosed, but the vulnerability description confirms the same fundamental pattern of unblocked interfaces enabling remote script loading.

Attack Flow

Based on the vulnerability description and the well-documented pattern of prior Foxit sandbox bypasses, exploitation of CVE-2026-12057 follows these steps:

1. The attacker creates a PDF document containing embedded JavaScript that targets one or more dangerous interfaces the Foxit sandbox does not intercept.

2. The attacker delivers the PDF to the victim, most commonly as an email attachment, a download link, or through a compromised document sharing platform. PDF-based attacks are particularly effective in phishing campaigns because businesses exchange PDF files routinely.

3. The victim opens the PDF in Foxit PDF Reader or Editor, and the embedded JavaScript runs inside the sandbox. Under normal circumstances, the sandbox would intercept calls to dangerous APIs and prevent them from executing.

4. The JavaScript calls interfaces that the sandbox does not intercept and uses them to load remote content, specifically external scripts hosted on attacker-controlled infrastructure.

5. The remotely loaded scripts execute with the privileges of the Foxit process, which gives the attacker arbitrary code execution on the victim's system.

Case Study: 2017 Safe Reading Mode Bypass via XFA Events

In 2017, researcher InsertScript documented that Foxit Reader's Safe Reading Mode, which is enabled by default to prohibit script execution, could be bypassed using XFA XML structures. An "initialized" event for a button element fired so early during PDF parsing that the security mode had not yet been applied. JavaScript could therefore execute before the protections were in place, a fundamental timing flaw in the sandbox initialization sequence. InsertScript showed that the xfa.host.gotoURL function could execute cmd.exe via the file:/// protocol, and that this.saveAs and xfa.host.exportData could drop .hta files to disk.

Case Study: 2017 Flash-Based Sandbox Escape

Researcher Bjorn Ruytenberg demonstrated that a modified PDF could make Foxit Reader run embedded Flash content outside the Safe Mode sandbox without any user interaction. The attack forced the underlying Flash Player to execute code within the local-trusted sandbox, which gave it unrestricted access to the victim's file system and to remote servers. This affected Foxit Reader and PhantomPDF versions 7.3.4.311 and earlier.

Case Study: 2022 Outdated V8 JavaScript Engine RCE

SEC Consult researcher R. Freingruber discovered that Foxit PDF Reader used an outdated version (7.7.299.6, from August 2019) of Google Chrome's V8 JavaScript engine, which was vulnerable to publicly known memory corruption flaws including CVE-2020-6418. Foxit had removed ArrayBuffer and BigUint32Array, and the exploit got around this by using SharedArrayBuffer together with DataView objects. It then used WebAssembly to allocate a memory region that was both writable and executable, which made shellcode execution possible. Foxit fixed this in version 12.0.1.

Related Attack Patterns

CWE-829 is associated with several CAPEC attack patterns, including CAPEC-175 (Code Inclusion), CAPEC-201 (Serialized Data External Linking), and CAPEC-228 (DTD Injection). For PDF-based attacks, CAPEC-175 is the most directly relevant, because in that pattern the attacker causes the application to download and execute code from an untrusted source.

Affected Systems and Versions

As of June 15, 2026, the NVD record for CVE-2026-12057 does not specify which Foxit product versions are vulnerable, and the Foxit security bulletins have not announced a fix version. Based on the nature of the vulnerability (a JavaScript sandbox bypass during PDF rendering), the affected products are Foxit PDF Reader and Foxit PDF Editor.

For reference, other recent Foxit CVEs have affected these version ranges:

Until Foxit publishes an advisory with version details, organizations should assume that current and recent versions of Foxit PDF Reader and Editor may be affected.

Recommended Workarounds

Until an official patch is available, these mitigations reduce the attack surface:

1. Verify that Safe Reading Mode is enabled. Go to File > Preferences > Trust Manager and confirm that "Enable safe reading mode" is checked. It is on by default but may have been disabled in some deployments. Past bypasses have shown that Safe Reading Mode is not always sufficient, but it does raise the bar for exploitation.

2. Disable JavaScript execution entirely in File > Preferences > JavaScript. This eliminates the attack vector, but it will break PDF forms and interactive features that rely on JavaScript.

3. Do not open PDF files from unknown or untrusted senders, particularly email attachments or downloads from unverified websites.

4. Use endpoint protection tools to detect and block suspicious child processes spawned by Foxit PDF Reader or Editor, which may indicate exploitation attempts.

5. Check the Foxit Security Bulletins page regularly for an official fix.

Vendor Security History

Foxit has a substantial, recurring history of security vulnerabilities in its JavaScript execution and sandbox implementation. Notable recent CVEs:

Foxit's sandbox and JavaScript handling have been found wanting again and again, with multiple arbitrary code execution vulnerabilities in 2025 and 2026 alone. The 2022 SEC Consult advisory showed that Foxit was shipping a V8 JavaScript engine from August 2019 that was vulnerable to publicly known memory corruption flaws. Foxit has also historically declined to patch certain vulnerabilities if exploiting them required Safe Reading Mode to be disabled. In those cases it relied on the sandbox as sufficient mitigation, even when bypasses were known.

The company does maintain a formal vulnerability disclosure process and states that "a prompt response to software defects and security vulnerabilities has been, and will continue to be, a top priority." Even so, the frequency and similarity of these CVEs suggest deeper architectural issues in the JavaScript sandbox, specifically its reliance on a blocklist instead of a comprehensive allowlist.

References

• NVD: CVE-2026-12057
• Foxit Security Bulletins
• CWE-829: Inclusion of Functionality from Untrusted Control Sphere
• CISA Known Exploited Vulnerabilities Catalog
• InsertScript: A Tale About Foxit Reader Safe Reading Mode
• Bjorn Ruytenberg: Foxit Reader Sandbox Bypass
• SEC Consult: Outdated JavaScript Engine Leads to RCE in Foxit PDF Reader
• Foxit KB: How to Disable Safe Reading Mode
• Locklizard: Why Using JavaScript in PDF Files is a Security Risk
• Foxit: Report Security Vulnerabilities
• NVD: CVE-2025-66493
• SentinelOne: CVE-2026-5943
• Action1: CVE-2026-1591