CVE-2026-57259

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local paths, thereby allowing access to any local files within the user's permission range.

• CWE-611

• https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57253An abnormal image object causes the renderer to enter the wr…6.1
• CVE-2026-57254There is an abnormal annotation within the PDF that is refer…7.8
• CVE-2026-57255The application opens a PDF containing an abnormal color spa…6.1
• CVE-2026-57256When the application opens a PDF and executes JavaScript, it…7.8
• CVE-2026-57257During the PRC parsing stage, there is a lack of boundary ve…6.1
• CVE-2026-57258The PRC file header parsing logic trusts the constructed fil…6.1
• CVE-2026-5726ASDA-Soft Stack-based Buffer Overflow Vulnerability8.4
• CVE-2026-57260The application opened a PDF file containing an abnormal Uni…7.8
• CVE-2026-57262A vulnerability has been identified in LOGO! Soft Comfort (A…6.8
• CVE-2026-57263A vulnerability has been identified in LOGO! Soft Comfort (A…7
• CVE-2026-57264GeoWebPlayer (also called "Web Plugin" in the GV-VMS documen…8.3
• CVE-2026-57265GeoWebPlayer (also called "Web Plugin" in the GV-VMS documen…8.3