CVE-2026-91792: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2026-91792 is a use-after-free vulnerability in Foxit PDF Editor/Reader triggered by malicious PDFs with JavaScript actions. Attackers can crash the application by forcing reentrant operations. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-91792 Overview

CVE-2026-91792 is a use-after-free vulnerability [CWE-416] affecting Foxit PDF Editor and Foxit PDF Reader. The flaw is triggered when the application processes a specially crafted PDF containing page- and annotation-related JavaScript actions. These actions can force reentrant zoom and layout operations, causing the application to access page objects after they have been released. Successful exploitation results in an application crash and creates conditions that can enable arbitrary code execution in the context of the current user.

Critical Impact
A local attacker who convinces a user to open a malicious PDF can trigger memory corruption in Foxit PDF Editor/Reader, potentially leading to arbitrary code execution with the user's privileges.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91792 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91792

Vulnerability Analysis

The vulnerability resides in how Foxit PDF Editor and Reader handle JavaScript actions tied to page and annotation events. When a crafted PDF invokes zoom or layout operations from within these JavaScript callbacks, the application enters a reentrant code path. During reentrancy, page objects can be released while other execution contexts still hold references to them. Subsequent access to those freed page objects produces a use-after-free condition. Exploitation requires the target user to open the malicious document, and code execution occurs within the security context of that user.

Root Cause

The root cause is insufficient lifetime management of page objects during reentrant zoom and layout operations invoked by PDF JavaScript. Foxit's rendering pipeline releases page objects before all dependent execution contexts complete, leaving dangling pointers. Referencing memory after free [CWE-416] enables an attacker to influence heap layout and potentially hijack control flow when the freed region is reallocated with attacker-controlled data.

Attack Vector

Exploitation requires local file processing and user interaction. An attacker delivers a crafted PDF through email attachments, malicious downloads, or web-hosted documents. When the victim opens the file in Foxit PDF Editor or Reader, embedded JavaScript triggers page or annotation actions that recursively invoke zoom or layout logic. The reentrant execution path frees a page object still referenced elsewhere, producing the use-after-free. The vulnerability does not require authentication or elevated privileges on the target host.

No public proof-of-concept exploit code is currently available for CVE-2026-91792. Refer to the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2026-91792

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF document
PDF files containing suspicious JavaScript actions bound to page-open, page-close, or annotation events that invoke zoom or layout APIs
Windows Error Reporting (WER) or crash dumps referencing access violations in Foxit rendering modules
Child processes spawned by Foxit binaries that do not match normal application behavior

Detection Strategies

Inspect inbound PDF attachments for embedded JavaScript that references zoom, layout, or annotation event handlers using static PDF analysis tools
Monitor endpoint telemetry for Foxit process crashes correlated with PDF file opens
Deploy behavioral detection to flag Foxit processes that perform unusual actions such as writing executables, invoking cmd.exe, or initiating outbound network connections

Monitoring Recommendations

Enable process creation and file access logging on hosts running Foxit PDF Editor or Reader
Correlate PDF open events with subsequent process crashes and heap corruption indicators
Track document delivery channels including email gateways and web proxies for high-volume or targeted PDF campaigns

How to Mitigate CVE-2026-91792

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the latest patched versions published in the Foxit Security Bulletins
Inventory all endpoints running Foxit PDF products and prioritize patch deployment on user workstations
Restrict opening of PDF files received from untrusted sources until patching is complete

Patch Information

Foxit publishes fixed builds through its security bulletins portal. Administrators should consult the Foxit Security Bulletins for the specific patched version addressing CVE-2026-91792 and deploy through standard software update mechanisms.

Workarounds

Disable JavaScript execution in Foxit PDF Editor and Reader via Preferences > JavaScript > Enable JavaScript Actions
Configure email gateways to strip or sandbox PDF attachments containing embedded JavaScript
Enforce application allowlisting to restrict which processes Foxit can spawn as children

bash

# Disable JavaScript in Foxit PDF Reader via registry (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f