🛡️ CVE-2026-57251 — pdf-editor

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack vector: Local — a local account, shell or session on the host is needed.
• Attack complexity: Low — the attack works reliably, with no preparation.
• Privileges required: None — an unauthenticated stranger can try it.
• User interaction: Required — someone has to click, open or visit something.
• Scope: Unchanged — the damage stays inside the vulnerable component.
• Confidentiality impact: High — total loss, or loss the attacker controls.
• Integrity impact: High — total loss, or loss the attacker controls.
• Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2026-57251 is classified as CWE-129: Improper Validation of Array Index. An index derived from input is used without a range check, so the access lands outside the array.

Affected software

CVE-2026-57251 is recorded against 2 packages.

• pdf-editor (from 2026.1.0.36452 up to 2026.1.1.36485)
• pdf-reader (fixed in 2026.1.1.36485)

Timeline and source

Published on 8 July 2026 and last revised on 9 July 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

www.foxit.com

Other advisories for this package

pdf-editor has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CVE-2026-57250 (7.8 High, published 8 Jul 2026)
• CVE-2026-57237 (7.8 High, published 8 Jul 2026)
• CVE-2026-57257 (6.1 Medium, published 8 Jul 2026)
• CVE-2026-57243 (6.1 Medium, published 8 Jul 2026)
• CVE-2026-57249 (7.8 High, published 8 Jul 2026)
• CVE-2026-57256 (7.8 High, published 8 Jul 2026)
• CVE-2026-57242 (7.8 High, published 8 Jul 2026)
• CVE-2026-13129 (7.8 High, published 8 Jul 2026)

Same weakness in other software

These advisories are the same class of weakness (CWE-129: Improper Validation of Array Index) in other software:

• CVE-2014-4616 (published 6 Jul 2026)
• CVE-2023-20601 (published 12 Feb 2026)
• CVE-2022-50315 (7.8 High, published 15 Sep 2025)
• CVE-2022-50066 (7.8 High, published 18 Jun 2025)
• CVE-2022-49478 (7.8 High, published 26 Feb 2025)
• CVE-2022-49471 (8.8 High, published 26 Feb 2025)
• CVE-2022-49186 (7.8 High, published 26 Feb 2025)
• CVE-2022-49170 (7.8 High, published 26 Feb 2025)

Details

Affected Packages

References