CVE-2026-91790: Foxit PDF Use After Free Vulnerability

CVE-2026-91790 is a use after free vulnerability in Foxit PDF Editor/Reader triggered by malformed image objects. Attackers can exploit this flaw to crash the application or potentially execute code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-91790 Overview

CVE-2026-91790 is a use-after-free (UAF) vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. The flaw exists in the page image rendering path, where the application fails to validate image objects containing malformed optional content attributes. When processing such an object, the program accesses an already-freed internal data structure, triggering a crash and potentially enabling arbitrary code execution in the context of the current user.

Exploitation requires a local attack vector with user interaction, typically achieved by convincing a user to open a crafted PDF document.

Critical Impact
Successful exploitation can lead to arbitrary code execution, information disclosure, or denial of service by processing a malicious PDF file.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletin for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91790 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91790

Vulnerability Analysis

The vulnerability is a use-after-free condition in Foxit PDF Editor and Foxit PDF Reader. During page image rendering, the application processes image objects that may include optional content attributes. These attributes control conditional visibility of graphic elements based on layers or context.

When the parser encounters malformed optional content attributes, it fails to enforce proper validation. The rendering routine then dereferences an internal data structure that has already been released. This unsafe access produces a crash and creates a window for memory corruption.

An attacker can craft a PDF document that shapes heap layout before triggering the free. Controlling the freed allocation lets the attacker influence the object read after free, which can escalate a crash into arbitrary code execution within the user's security context.

Root Cause

The root cause is missing validation on image object attributes combined with an incorrect object lifecycle. The renderer holds a reference to an image object whose backing structure is freed during attribute processing. No sanity check confirms the object is still valid before the subsequent dereference, matching the [CWE-416] Use After Free pattern.

Attack Vector

Exploitation requires a user to open a crafted PDF file with a vulnerable Foxit version. The attack vector is local, but delivery is typically remote through email attachments, drive-by downloads, or shared file storage. No elevated privileges are required to trigger the flaw.

See the Foxit Security Bulletin for additional technical details.

Detection Methods for CVE-2026-91790

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe following the opening of a PDF file
PDF documents containing malformed optional content group (OCG) attributes attached to image XObjects
Child process creation from Foxit processes, such as command shells or script interpreters
Anomalous outbound network connections initiated by the Foxit process shortly after document open

Detection Strategies

Monitor endpoint telemetry for crash events tied to Foxit processes with faulting modules in image or rendering libraries
Inspect PDF files for image objects with unusual or malformed /OC (Optional Content) entries using PDF analysis tools
Correlate document open events with subsequent process, file, and network activity to identify exploitation chains

Monitoring Recommendations

Enable process and module load logging on endpoints running Foxit software
Ingest Windows Error Reporting and application crash logs into a centralized log platform for review
Track email gateway and web proxy telemetry for PDF files originating from untrusted senders or domains

How to Mitigate CVE-2026-91790

Immediate Actions Required

Inventory all endpoints running Foxit PDF Editor and Foxit PDF Reader and identify vulnerable versions
Apply the vendor-supplied security update from the Foxit Security Bulletin as soon as it is available
Restrict opening of PDF files received from untrusted sources until patching is complete
Educate users about the risk of opening unsolicited PDF attachments

Patch Information

Foxit has published a security bulletin describing the fix. Administrators should consult the Foxit Security Bulletin for the fixed version numbers and download the corresponding updates. Deploy updates through the standard patch management workflow and verify version strings on endpoints after installation.

Workarounds

Configure email and web gateways to sandbox or strip PDF attachments from untrusted senders
Use an alternate PDF viewer with vendor-supported security posture for high-risk document handling
Disable automatic PDF rendering in browsers and email clients pending patch deployment
Apply application allowlisting to prevent Foxit processes from spawning unexpected child processes

bash

# Configuration example: verify installed Foxit version on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | \
  Where-Object { $_.DisplayName -like "Foxit PDF*" } | \
  Select-Object DisplayName, DisplayVersion, InstallLocation