CVE-2026-91799: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2026-91799 Overview

CVE-2026-91799 is a use-after-free vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the application's handling of JavaScript array objects embedded in PDF documents. A specially crafted PDF can cause the application to access a released object during array processing. Successful exploitation can lead to application crashes or arbitrary code execution in the context of the current user.

The vulnerability is categorized under CWE-416: Use After Free and requires user interaction. A victim must open a malicious PDF file for exploitation to succeed.

Critical Impact
An attacker who convinces a user to open a crafted PDF can execute arbitrary code with the privileges of the user running Foxit PDF Editor or Reader.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Specific affected versions: Not Available (refer to Foxit Security Bulletins)

Discovery Timeline

2026-09-23 - CVE-2026-91799 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91799

Vulnerability Analysis

The vulnerability affects the JavaScript engine embedded within Foxit PDF Editor and Reader. PDF documents can contain JavaScript that manipulates array objects during rendering or form interaction. Foxit's implementation fails to correctly track object lifetimes when scripted array operations execute. The application continues to reference a memory region after the underlying array object has been freed.

When the freed memory is reallocated with attacker-controlled data, subsequent access can redirect execution flow. This produces the conditions for arbitrary code execution within the process. If the reallocated region does not contain valid data, the process crashes and causes a denial of service.

Exploitation requires the victim to open a malicious PDF. The attack executes with the privileges of the local user running the affected Foxit application. No network access to the target is required beyond delivering the file through email, web download, or file share.

Root Cause

The root cause is improper object lifetime management in the JavaScript array handling code path [CWE-416]. Foxit's engine releases the backing memory of an array object while dangling references remain reachable from script-visible state. Subsequent operations dereference the stale pointer and operate on memory the allocator may have reassigned.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a PDF containing embedded JavaScript that triggers the use-after-free during array manipulation. Delivery mechanisms include phishing emails with PDF attachments, drive-by downloads, and malicious documents hosted on compromised sites. When the user opens the file, the embedded script executes and reaches the vulnerable code path. Technical details of the exploitation primitive are documented in the Foxit Security Bulletins.

Detection Methods for CVE-2026-91799

Indicators of Compromise

PDF files containing embedded JavaScript with unusual array allocation and deallocation patterns, such as repeated resizing followed by object property access
Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe with access violation exceptions during PDF rendering
Foxit application processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by Foxit processes to unknown or low-reputation hosts shortly after a PDF is opened

Detection Strategies

Inspect PDF attachments at the email gateway for embedded JavaScript that manipulates array objects, oversized array allocations, or heap-spray patterns
Correlate Foxit process crashes with recent file open events to identify potential exploitation attempts against endpoints
Apply YARA rules targeting PDF structures with suspicious /JS and /JavaScript action dictionaries combined with heap manipulation primitives

Monitoring Recommendations

Enable process creation and command-line auditing on endpoints running Foxit software to capture parent-child relationships
Monitor for Foxit processes writing executables or scripts to user-writable directories including %TEMP%, %APPDATA%, and Downloads
Alert on Foxit processes loading unsigned DLLs or performing memory allocations consistent with shellcode staging

How to Mitigate CVE-2026-91799

Immediate Actions Required

Update Foxit PDF Editor and Foxit PDF Reader to the latest version published in the Foxit Security Bulletins
Disable JavaScript execution in Foxit applications until patches are applied across the environment
Restrict opening of untrusted PDF attachments through email security policies and user awareness communications
Inventory all endpoints running Foxit software and prioritize patching for users who routinely handle external PDFs

Patch Information

Foxit publishes fixed versions and release notes through the Foxit Security Bulletins page. Administrators should consult the bulletin corresponding to CVE-2026-91799 to confirm the minimum patched version for both Foxit PDF Editor and Foxit PDF Reader before deployment.

Workarounds

Disable JavaScript in Foxit preferences under File > Preferences > JavaScript by clearing the Enable JavaScript Actions option
Configure endpoint policies to open PDF files in a sandboxed or protected view mode where available
Route inbound PDF attachments through a content disarm and reconstruction (CDR) pipeline to strip embedded scripts
Apply application allowlisting rules that prevent Foxit processes from spawning shell interpreters or writing executable content

bash

# Configuration example: disable JavaScript in Foxit via registry (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f