CVE-2026-91791: Foxit PDF Use-After-Free Vulnerability

CVE-2026-91791 Overview

CVE-2026-91791 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. The flaw occurs when the application processes a specially crafted PDF file that triggers reentrant JavaScript execution through page-visibility events. During annotation boundary calculations, the application accesses a page-view object that has already been released, resulting in an invalid memory read and application crash. Exploitation requires local file access and user interaction to open the malicious PDF.

Critical Impact
A crafted PDF can force Foxit to reference freed memory during annotation processing, enabling application crash and potential memory corruption impacting confidentiality, integrity, and availability.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91791 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91791

Vulnerability Analysis

The vulnerability resides in Foxit's handling of JavaScript execution tied to page-visibility events within PDF documents. When a user opens a crafted PDF, embedded JavaScript re-enters the rendering pipeline while the application is still calculating annotation boundaries. This reentrant execution path releases the underlying page-view object before the boundary calculation completes. The subsequent access to the freed object results in an invalid memory read.

The issue is classified under [CWE-416] Use After Free. While the immediate observable effect is an application crash, use-after-free conditions in rendering engines commonly serve as primitives for arbitrary code execution when combined with heap grooming techniques.

Root Cause

The root cause is a lifetime management error between the JavaScript engine and the annotation rendering subsystem. Page-visibility event handlers can execute JavaScript that invalidates the page-view object while another code path still holds a stale reference. No synchronization or reference validation exists before the annotation boundary calculation dereferences the page-view pointer.

Attack Vector

An attacker crafts a PDF containing JavaScript that registers a handler on page-visibility state changes. When the victim opens the file in Foxit PDF Editor or Reader, changing page visibility triggers the handler, which manipulates the document structure to release the page-view object. The annotation boundary calculation then dereferences the freed pointer. Exploitation requires local access and user interaction to open the malicious file.

No verified proof-of-concept code is publicly available. See the Foxit Security Bulletins for vendor-provided technical details.

Detection Methods for CVE-2026-91791

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF file
Windows Error Reporting (WER) entries citing access violations in Foxit modules during PDF rendering
Inbound PDF attachments containing JavaScript that references page-visibility APIs and annotation manipulation

Detection Strategies

Inspect PDF attachments statically for /JS and /JavaScript action dictionaries combined with visibility-state event handlers
Monitor endpoint telemetry for Foxit processes terminating abnormally with exception codes such as 0xC0000005
Correlate PDF file arrival from email or web downloads with subsequent Foxit process crashes

Monitoring Recommendations

Enable crash reporting and forward Foxit crash telemetry to your SIEM for correlation
Track process creation and termination events for Foxit binaries alongside parent process context
Alert on Foxit child processes spawning shells, scripting hosts, or LOLBins immediately after a PDF open event

How to Mitigate CVE-2026-91791

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the latest version listed in the Foxit Security Bulletins
Restrict opening of PDF files received from untrusted sources until patches are deployed
Disable JavaScript execution within Foxit PDF Editor and Reader via application preferences

Patch Information

Foxit publishes fixed versions and remediation guidance through the Foxit Security Bulletins portal. Administrators should identify the affected build in their environment and deploy the vendor-supplied update.

Workarounds

Disable JavaScript in Foxit via Preferences → JavaScript → uncheck Enable JavaScript Actions
Enforce Safe Reading Mode to limit execution of dynamic content in PDFs
Use email gateway policies to strip or sandbox PDF attachments containing embedded JavaScript

bash

# Group Policy registry key to disable JavaScript in Foxit PDF Reader/Editor
# HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript
# Value: bJSEnable = 0 (REG_DWORD)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f