CVE-2026-12057

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.foxit.com/support/security-bulletins.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:foxit:ai:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Cuando la aplicación ejecuta el script de JavaScript incrustado en el PDF dentro del sandbox, no logra interceptar algunas interfaces peligrosas, lo que permite que se carguen scripts remotos, resultando en ejecución de código arbitrario.

Information

Published : 2026-06-15 12:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12057

Mitre link : CVE-2026-12057

CVE.ORG link : CVE-2026-12057

JSON object : View

Products Affected

foxit

ai

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-12057", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12057", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-15T12:32:53.206295Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "affectedData": [{"vendor": "Foxit Software Inc.", "product": "Foxit AI", "versions": [{"status": "affected", "version": "before 2026-06-15"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-15T12:16:23.050", "references": [{"url": "https://www.foxit.com/support/security-bulletins.html", "tags": ["Vendor Advisory"], "source": "14984358-7092-470d-8f34-ade47a7658a2"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "description": [{"lang": "en", "value": "CWE-829"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution."}, {"lang": "es", "value": "Cuando la aplicaci\u00f3n ejecuta el script de JavaScript incrustado en el PDF dentro del sandbox, no logra interceptar algunas interfaces peligrosas, lo que permite que se carguen scripts remotos, resultando en ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:foxit:ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30F4F27A-44DB-45CE-AC19-90B7E370FB8A", "versionEndExcluding": "2026-06-15"}], "operator": "OR"}]}], "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2"}