CVE-2026-91802: Foxit PDF Editor Buffer Overflow Flaw

CVE-2026-91802 Overview

CVE-2026-91802 is a heap-based out-of-bounds write vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the WebP image decoding component, where the application improperly handles bitmap stride and target buffer formats during decode operations. An attacker who convinces a user to open a crafted document or image can trigger memory corruption on the heap. Successful exploitation results in application crashes and may enable arbitrary code execution within the user's security context. The issue is tracked under CWE-787: Out-of-bounds Write.

Critical Impact
Local exploitation through a malicious WebP-bearing document can corrupt heap memory in Foxit PDF Editor/Reader, leading to crashes and potential code execution under the current user.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Specific version ranges: refer to Foxit Security Bulletins

Discovery Timeline

2026-09-23 - CVE-2026-91802 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91802

Vulnerability Analysis

The vulnerability exists in Foxit's WebP image decoding path used by both Foxit PDF Editor and Foxit PDF Reader. WebP decoding requires the decoder to correctly compute the destination bitmap stride, which is the byte width of each row in memory. It must also account for the pixel format of the target buffer, such as RGB, RGBA, or BGRA. When these values are mismatched or improperly validated, the decoder writes pixel data past the end of the allocated heap buffer.

This heap-based out-of-bounds write corrupts adjacent heap metadata or object pointers. The corruption reliably produces an application crash and, depending on the heap layout at exploitation time, may allow an attacker to influence subsequent control-flow decisions. The condition is classified as CWE-787: Out-of-bounds Write.

Root Cause

The root cause is improper handling of bitmap stride and target buffer format during WebP decoding. The decoder relies on assumed alignment or format properties without validating them against the destination buffer's actual geometry. Any mismatch between the source WebP frame dimensions or pixel layout and the allocated destination buffer results in writes beyond the buffer boundary.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a specially crafted PDF or WebP asset to the target and induces the user to open it in a vulnerable Foxit product. Common delivery mechanisms include email attachments, malicious downloads, and phishing links pointing to weaponized documents. No elevated privileges are required to trigger the flaw; the impact occurs in the context of the user running Foxit.

No public proof-of-concept exploit is currently referenced in the CVE record. Refer to the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2026-91802

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe immediately after opening a PDF or WebP file.
Windows Error Reporting entries or crash dumps referencing access violations inside Foxit WebP decoding modules.
PDF documents containing embedded WebP images from untrusted senders, particularly with anomalous image dimensions or stride values.

Detection Strategies

Hunt for process crash telemetry where Foxit executables terminate abnormally after loading files with .pdf or .webp extensions.
Inspect email gateways and web proxies for PDF attachments carrying WebP payloads originating from unverified sources.
Correlate endpoint file-open events with subsequent process termination and heap corruption exceptions.

Monitoring Recommendations

Enable and forward Windows Error Reporting and application crash logs to a centralized SIEM for retrospective analysis.
Monitor child process creation from Foxit binaries; any spawned command shell or scripting host after a document open warrants investigation.
Alert on file writes to autorun locations or persistence keys that occur in the same session as a Foxit process crash.

How to Mitigate CVE-2026-91802

Immediate Actions Required

Apply the latest Foxit PDF Editor and Foxit PDF Reader updates as listed in the Foxit Security Bulletins.
Restrict opening of PDF and WebP files from untrusted or unverified sources until patches are deployed across the fleet.
Enforce least-privilege on user accounts that routinely handle external documents to limit post-exploitation impact.

Patch Information

Foxit has published fixed versions through its security bulletin process. Administrators should consult the Foxit Security Bulletins to identify the specific product versions containing the fix and deploy them through standard software update channels.

Workarounds

Disable or block automatic rendering of WebP images inside PDFs where the application configuration permits.
Route inbound documents through a sandboxed viewer or content disarm and reconstruction (CDR) pipeline before user access.
Configure email and web filtering to strip or quarantine PDF attachments containing embedded WebP streams from external senders.

bash

# Example: block Foxit executables from spawning script interpreters via WDAC or AppLocker
# Sample AppLocker rule fragment (illustrative)
<FilePathRule Id="block-foxit-child-shells" Name="Block Foxit spawning cmd/powershell" Action="Deny">
  <Conditions>
    <FilePathCondition Path="%SYSTEM32%\cmd.exe" />
    <FilePathCondition Path="%SYSTEM32%\WindowsPowerShell\v1.0\powershell.exe" />
  </Conditions>
</FilePathRule>