CVE-2026-91795: Foxit PDF Editor RCE Vulnerability

CVE-2026-91795 Overview

Foxit PDF Editor and Foxit PDF Reader contain a memory corruption vulnerability in the FileOpen plugin. The plugin fails to adequately validate encryption metadata within specially crafted PDF files. This validation gap leaves an internal pointer in an invalid state. Attackers can trigger chained read and write access violations that potentially enable arbitrary code execution [CWE-822: Untrusted Pointer Dereference].

Exploitation requires local access and user interaction, such as opening a malicious PDF document. Successful exploitation compromises confidentiality, integrity, and availability of the affected system.

Critical Impact

A crafted PDF opened in Foxit PDF Editor or Reader can corrupt an internal pointer in the FileOpen plugin and lead to arbitrary code execution in the context of the user.

Affected Products

• Foxit PDF Editor (FileOpen plugin)
• Foxit PDF Reader (FileOpen plugin)
• Refer to the Foxit Security Bulletin for specific affected versions

Discovery Timeline

• 2026-09-23 - CVE-2026-91795 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91795

Vulnerability Analysis

The flaw resides in Foxit's FileOpen plugin, which processes rights-managed PDF documents protected with FileOpen digital rights management. The plugin parses encryption metadata embedded in the PDF structure but does not enforce sufficient validation on specific fields. A malformed metadata block causes an internal pointer to reference invalid memory.

Subsequent operations dereference the corrupted pointer for both read and write access. This chained behavior produces access violations that an attacker can shape into a controlled memory corruption primitive. With careful crafting, the primitive supports arbitrary code execution within the process context of the user opening the file.

Root Cause

The vulnerability maps to [CWE-822: Untrusted Pointer Dereference]. The FileOpen plugin trusts pointer-derived values built from attacker-controlled encryption metadata without validating that the resulting pointer references a legitimate object. This trust gap converts a parsing bug into a memory safety violation.

Attack Vector

An attacker crafts a PDF containing manipulated FileOpen encryption metadata. The victim opens the document in a vulnerable version of Foxit PDF Editor or Reader. The FileOpen plugin processes the metadata, corrupts an internal pointer, and executes attacker-controlled memory operations. Delivery typically occurs through email attachments, malicious downloads, or drive-by document delivery. No authentication is required, but user interaction is mandatory.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. Refer to the Foxit Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-91795

Indicators of Compromise

• Foxit PDF processes (FoxitPDFReader.exe, FoxitPDFEditor.exe) crashing with access violation exceptions shortly after opening a PDF
• PDF files containing anomalous or malformed FileOpen encryption dictionaries (/Filter /FOPN_foweb entries with irregular parameters)
• Unexpected child process creation from a Foxit process, such as cmd.exe, powershell.exe, or rundll32.exe
• Outbound network connections initiated by a Foxit process immediately after document open

Detection Strategies

• Monitor Windows Error Reporting and application crash telemetry for Foxit binaries with exception codes 0xC0000005
• Inspect PDF files at email and web gateways for FileOpen DRM structures with malformed encryption metadata
• Apply behavioral rules that flag Foxit processes spawning shells, script interpreters, or LOLBins
• Correlate Foxit process activity with suspicious module loads or memory allocations marked as executable

Monitoring Recommendations

• Enable command-line and process-creation logging (Sysmon Event ID 1) on endpoints running Foxit software
• Alert on Foxit processes writing executables to %TEMP%, %APPDATA%, or %PUBLIC%
• Track network egress from PDF reader processes to non-corporate destinations

How to Mitigate CVE-2026-91795

Immediate Actions Required

• Identify all endpoints running Foxit PDF Editor or Foxit PDF Reader and inventory installed versions
• Apply the patched version referenced in the Foxit Security Bulletin as soon as it is available in your environment
• Restrict opening of PDF files from untrusted sources until patches are deployed
• Enforce least-privilege user contexts so exploitation cannot escalate beyond the current user

Patch Information

Foxit has published remediation guidance through its security bulletins portal. Consult the Foxit Security Bulletin for the fixed release numbers for both Foxit PDF Editor and Foxit PDF Reader, then deploy the update through your standard software distribution tooling.

Workarounds

• Disable the FileOpen plugin within Foxit PDF Editor/Reader if FileOpen DRM is not required in your environment
• Configure email and web gateways to strip or quarantine PDFs originating from external senders when FileOpen DRM is not expected
• Set an alternative default PDF handler for untrusted documents and reserve Foxit for known, trusted content

# Example: disable FileOpen plugin registry key on Windows endpoints
# Review the exact key name in your Foxit deployment before applying
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Plugins\FileOpen" /v Enabled /t REG_DWORD /d 0 /f