CVE-2026-12057CWE-829

DoS + Remote Code Execution via PDF JavaScript in Foxit AI

High · published June 15, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-06-15T10:21Z
EPSS history
Timeline
  • 15 JUN 10:21Z
    DoS + Remote Code Execution via PDF JavaScript in Foxit AI
    cvelistv5