CVE-2026-12057

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.foxit.com/support/security-bulletins.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:foxit:ai:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-15 12:16

Updated : 2026-06-17 10:14

NVD link : CVE-2026-12057

Mitre link : CVE-2026-12057

CVE.ORG link : CVE-2026-12057

JSON object : View

Products Affected

foxit

ai

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-12057", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12057", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-15T12:32:53.206295Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "affectedData": [{"vendor": "Foxit Software Inc.", "product": "Foxit AI", "versions": [{"status": "affected", "version": "before 2026-06-15"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-15T12:16:23.050", "references": [{"url": "https://www.foxit.com/support/security-bulletins.html", "tags": ["Vendor Advisory"], "source": "14984358-7092-470d-8f34-ade47a7658a2"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "description": [{"lang": "en", "value": "CWE-829"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution."}], "lastModified": "2026-06-17T10:14:36.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:foxit:ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30F4F27A-44DB-45CE-AC19-90B7E370FB8A", "versionEndExcluding": "2026-06-15"}], "operator": "OR"}]}], "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2"}