CVE-2026-57242
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The vulnerability in the PDF viewing application stems from incomplete lifecycle management and null value validation of objects. JavaScript modifies the form, and when the page state changes, the application repeatedly dereferences invalid objects, eventually causing a crash.
Risk Assessment
The risk involves an attacker potentially triggering an application crash, leading to denial of service (DoS) and disruption of critical functions.
Recommendation
It is recommended to immediately update the software to a version that includes fixes for object lifecycle management and null value validation. Additionally, consider restricting JavaScript execution in the PDF viewer.
Original NVD description (English source)
The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash.