{"api_version":"1","generated_at":"2026-06-16T23:24:55+00:00","cve":"CVE-2026-12057","urls":{"html":"https://cve.report/CVE-2026-12057","api":"https://cve.report/api/cve/CVE-2026-12057.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-12057","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12057"},"summary":{"title":"DoS + Remote Code Execution via PDF JavaScript in Foxit AI","description":"When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.","state":"PUBLISHED","assigner":"Foxit","published_at":"2026-06-15 12:16:23","updated_at":"2026-06-16 16:43:11"},"problem_types":["CWE-829","CWE-829 CWE-829 Inclusion of functionality from untrusted control sphere"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","name":"https://www.foxit.com/support/security-bulletins.html","refsource":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12057","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12057","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Foxit Software Inc.","product":"Foxit AI","version":"affected before 2026-06-15","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"mrfathoni","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"12057","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"foxit","cpe5":"ai","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-12057","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-15T12:32:53.206295Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-06-15T12:34:17.323Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Foxit AI","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-06-15"}]}],"credits":[{"lang":"en","type":"finder","value":"mrfathoni"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution."}],"value":"When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution."}],"impacts":[{"capecId":"CAPEC-175","descriptions":[{"lang":"en","value":"CAPEC-175 Code Inclusion"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-829","description":"CWE-829 Inclusion of functionality from untrusted control sphere","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-15T10:21:22.196Z","orgId":"14984358-7092-470d-8f34-ade47a7658a2","shortName":"Foxit"},"references":[{"url":"https://www.foxit.com/support/security-bulletins.html"}],"source":{"discovery":"UNKNOWN"},"title":"DoS + Remote Code Execution via PDF JavaScript in Foxit AI","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"14984358-7092-470d-8f34-ade47a7658a2","assignerShortName":"Foxit","cveId":"CVE-2026-12057","datePublished":"2026-06-15T10:21:22.196Z","dateReserved":"2026-06-12T02:37:21.297Z","dateUpdated":"2026-06-15T12:34:17.323Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-15 12:16:23","lastModifiedDate":"2026-06-16 16:43:11","problem_types":["CWE-829","CWE-829 CWE-829 Inclusion of functionality from untrusted control sphere"],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:ai:*:*:*:*:*:*:*:*","versionEndExcluding":"2026-06-15","matchCriteriaId":"30F4F27A-44DB-45CE-AC19-90B7E370FB8A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"12057","Ordinal":"1","Title":"DoS + Remote Code Execution via PDF JavaScript in Foxit AI","CVE":"CVE-2026-12057","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"12057","Ordinal":"1","NoteData":"When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.","Type":"Description","Title":"DoS + Remote Code Execution via PDF JavaScript in Foxit AI"}]}}}