CVE-2026-91788: Foxit PDF Information Disclosure Flaw

CVE-2026-91788 Overview

CVE-2026-91788 affects Foxit PDF Editor and Foxit PDF Reader. The vulnerability stems from the JavaScript interface failing to enforce attribute authorization checks required by the PDF specification. A trusted malicious PDF opened in the same process as other documents can access sensitive content from those documents and transmit it externally. The flaw is categorized as [CWE-668] Exposure of Resource to Wrong Sphere. Exploitation requires local access and user interaction to open a crafted document, and attack complexity is high. Successful exploitation results in confidentiality impact without affecting integrity or availability.

Critical Impact

A malicious PDF can read sensitive content from unrelated documents opened in the same Foxit process and exfiltrate it to an attacker-controlled endpoint.

Affected Products

• Foxit PDF Editor
• Foxit PDF Reader
• Refer to the Foxit Security Bulletins for exact affected versions

Discovery Timeline

• 2026-09-23 - CVE-2026-91788 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in the NVD database

Technical Details for CVE-2026-91788

Vulnerability Analysis

The PDF specification defines attribute authorization rules that govern how JavaScript executing inside one document may reference objects, streams, and metadata belonging to other documents. Foxit PDF Editor and Foxit PDF Reader implement the JavaScript interface but omit these authorization checks. When multiple PDFs are open in the same process, a malicious document that the user trusts can query attributes belonging to a sibling document. The reader returns the requested content instead of denying the cross-document access. The attacker's script can then serialize the retrieved data and transmit it over the network using standard PDF JavaScript networking primitives. The end result is a cross-document information disclosure that bypasses the isolation model users expect from a PDF viewer.

Root Cause

The root cause is missing authorization enforcement in the JavaScript interface layer. The specification treats attribute access on foreign document objects as a privileged operation that must be validated against the calling document's authorization context. Foxit's implementation skips that validation. Because both documents share a single process, in-memory objects belonging to the victim document are reachable through the JavaScript object graph exposed to the attacker document.

Attack Vector

An attacker delivers a crafted PDF and convinces the user to open it, typically alongside a document containing sensitive data such as a contract, financial statement, or internal report. The user must also grant the malicious PDF trusted status, which enables the elevated JavaScript APIs required to reach cross-document attributes and outbound networking. Once trusted, the embedded JavaScript enumerates other documents in the process, extracts targeted attributes, and posts them to an external server. No memory corruption or elevated privileges are required. The vulnerability class is Information Disclosure driven by Broken Access Control in the scripting engine.

Detection Methods for CVE-2026-91788

Indicators of Compromise

• Outbound HTTP or HTTPS connections originating from FoxitPDFReader.exe or FoxitPDFEditor.exe to non-Foxit domains shortly after a PDF is opened
• PDF files containing JavaScript that references Doc objects other than the currently executing document
• User prompts approving trust for a PDF received from an untrusted email or download source

Detection Strategies

• Inspect PDF content for JavaScript actions invoking cross-document object references or app.activeDocs enumeration paired with network APIs
• Correlate process telemetry from Foxit binaries with unexpected DNS queries or outbound socket activity
• Alert on Foxit processes writing to temporary files immediately followed by network egress to newly observed domains

Monitoring Recommendations

• Ingest endpoint process and network telemetry into a centralized analytics platform to identify anomalous Foxit egress patterns
• Baseline expected outbound destinations for Foxit binaries and flag deviations for review
• Track PDF trust prompts and repeated grants across the user base to identify social-engineering campaigns

How to Mitigate CVE-2026-91788

Immediate Actions Required

• Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the Foxit Security Bulletins
• Instruct users not to grant trusted status to PDFs received from external or unverified sources
• Avoid opening untrusted PDFs in the same session as sensitive documents until the patch is deployed

Patch Information

Foxit publishes fixed builds and version details through its security bulletin portal. Administrators should consult the Foxit Security Bulletins advisory for CVE-2026-91788 to obtain the specific patched versions of Foxit PDF Editor and Foxit PDF Reader and to align internal patch cycles with the vendor release.

Workarounds

• Disable JavaScript execution in Foxit PDF Editor and Reader through Preferences until patched builds are installed
• Enforce Safe Reading Mode to restrict elevated JavaScript APIs, including network calls from PDF scripts
• Deploy application allowlisting or egress filtering to block Foxit binaries from communicating with unapproved destinations