CVE-2026-91793: Foxit PDF Use-After-Free Vulnerability

CVE-2026-91793 Overview

CVE-2026-91793 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. The flaw occurs when the application processes a specially crafted PDF containing JavaScript that modifies annotation rich-text attributes with malformed font data. During subsequent annotation appearance reconstruction, the application accesses an object that has already been released. Successful exploitation can lead to application crash or arbitrary code execution in the context of the current user.

Critical Impact
An attacker who convinces a user to open a malicious PDF can trigger memory corruption and potentially execute code with the privileges of the Foxit application.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91793 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91793

Vulnerability Analysis

The vulnerability resides in how Foxit PDF Editor and Reader handle annotation rich-text attributes when embedded JavaScript modifies font-related data. A crafted PDF triggers script execution that alters annotation properties containing malformed font structures. When the application then rebuilds the annotation's visual appearance, it dereferences a pointer to an object that has already been freed.

This use-after-free condition [CWE-416] leaves the freed memory region reachable through a stale reference. An attacker can groom the heap to place attacker-controlled data in the released allocation. Subsequent reads or writes through the dangling pointer allow the attacker to influence execution flow, corrupt adjacent structures, or crash the process.

Root Cause

The root cause is missing lifetime management between the JavaScript engine that mutates annotation rich-text attributes and the appearance-reconstruction routine that consumes those attributes. The reconstruction path does not validate that referenced font objects remain valid after the scripted modification, permitting access to released memory.

Attack Vector

Exploitation requires local user interaction. The victim must open a crafted PDF file in a vulnerable version of Foxit PDF Editor or Reader. The document's embedded JavaScript performs the annotation manipulation that triggers the free, and the vulnerable code path executes when the annotation appearance is regenerated. No network access or elevated privileges are required for the attacker to deliver the payload.

No verified public exploit code or proof-of-concept is available at the time of publication. See the Foxit Security Bulletins for additional technical detail.

Detection Methods for CVE-2026-91793

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF from email, chat, or web downloads
PDF files containing JavaScript actions that repeatedly modify annotation RC (rich content) or font descriptor attributes
Child processes spawned by the Foxit application that do not correspond to normal document rendering activity

Detection Strategies

Inspect inbound PDFs at email and web gateways for embedded JavaScript that manipulates annotation appearance streams and font references
Monitor endpoint telemetry for Foxit process crashes correlated with recent PDF file opens
Hunt for anomalous memory access violations or exception events originating in Foxit modules within Windows Error Reporting logs

Monitoring Recommendations

Enable process and command-line logging on endpoints that run Foxit products to capture child process creation and module loads
Forward Foxit application crash telemetry to a centralized data lake for correlation with document delivery events
Track file provenance metadata (Mark-of-the-Web) on PDFs opened by Foxit to prioritize investigation of internet-sourced documents

How to Mitigate CVE-2026-91793

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the vendor's security bulletin
Inventory endpoints running Foxit products and prioritize patching for users who routinely open external PDFs
Advise users to avoid opening PDFs from untrusted sources until patches are deployed

Patch Information

Foxit has published remediation details in the Foxit Security Bulletins. Administrators should identify the fixed build for their installed product line and deploy it through their standard software distribution process.

Workarounds

Disable JavaScript execution within Foxit PDF Editor and Reader through Preferences > JavaScript > Enable JavaScript Actions until patched builds are installed
Restrict PDF file associations so untrusted documents open in a sandboxed viewer or protected view
Apply attachment filtering at the email gateway to quarantine PDFs containing embedded scripts from external senders

bash

# Configuration example: disable JavaScript in Foxit via registry (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f