CVE-2026-57256
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
When opening a PDF with embedded JavaScript, the application performs abnormal operations on a list box field, repeated after form reset. The application fails to properly validate form objects and their internal dictionary pointers, leading to an illegal pointer read and application crash.
Risk Assessment
An attacker can exploit this vulnerability to cause a denial of service by crashing the application via a crafted PDF file. This may disrupt system operations and affect service availability.
Recommendation
Immediately update the software to a version that fixes form object and dictionary pointer validation. Until updated, avoid opening untrusted PDF files.
Other vulnerabilities in PDF Reader
Original NVD description (English source)
When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash.