CVE-2026-91804: Foxit PDF Buffer Overflow Vulnerability

CVE-2026-91804 is a heap-based buffer overflow flaw in Foxit PDF Editor/Reader that triggers during Circle annotation rendering. Attackers can exploit this to crash applications or corrupt memory. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-91804 Overview

CVE-2026-91804 is a heap-based out-of-bounds write vulnerability in Foxit PDF Editor and Foxit Reader. The flaw resides in the rendering path for Circle annotations that use malformed Cloudy appearance streams inside crafted PDF files. Insufficient validation of the appearance geometry allows memory corruption and application crashes when a victim opens a weaponized document. The issue is tracked as CWE-787: Out-of-bounds Write and requires user interaction to trigger. Successful exploitation can lead to arbitrary code execution in the context of the current user.

Critical Impact
Opening a crafted PDF can corrupt heap memory in Foxit PDF Editor/Reader, enabling code execution or denial of service in the user's session.

Affected Products

Foxit PDF Editor (versions listed in the vendor bulletin)
Foxit Reader (versions listed in the vendor bulletin)
Refer to the Foxit Security Bulletins for the exact affected builds

Discovery Timeline

2026-09-23 - CVE-2026-91804 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91804

Vulnerability Analysis

The vulnerability lives in the annotation rendering subsystem of Foxit PDF Editor and Reader. Circle annotations support an optional Cloudy border effect, defined through a BE (Border Effect) dictionary entry that instructs the renderer to draw scalloped arcs along the ellipse's perimeter. When Foxit builds the appearance stream for a Cloudy Circle annotation, it computes vertex and control-point data derived from attacker-controlled geometry fields. The code writes those computed points into a heap-allocated buffer without adequately validating the resulting element count against the buffer's capacity. A crafted PDF that supplies malformed geometry, intensity, or bounding-box values causes the writer to exceed the allocation and corrupt adjacent heap metadata or object pointers.

Root Cause

The root cause is missing bounds enforcement between the parsed annotation parameters and the destination buffer used to store generated appearance primitives [CWE-787]. The renderer trusts the derived vertex count instead of clamping it to the allocation size, so any oversized or malformed Cloudy path produces an out-of-bounds write.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious PDF through email, chat, a shared drive, or a drive-by download. The victim opens the document in a vulnerable Foxit build, triggering annotation rendering during the initial page paint. The resulting heap corruption can crash the application or, with reliable heap grooming, redirect execution to attacker-controlled data. No network privileges or authentication are required on the target system.

No verified proof-of-concept code is available for CVE-2026-91804. See the Foxit Security Bulletins for vendor-supplied technical details.

Detection Methods for CVE-2026-91804

Indicators of Compromise

Foxit PDF Editor or Reader processes terminating unexpectedly shortly after a user opens a PDF attachment.
Windows Error Reporting or crash dumps referencing heap corruption inside Foxit annotation rendering modules.
PDF files containing Circle annotations with /BE Cloudy effect entries and unusual /I intensity or bounding-box values received from untrusted sources.

Detection Strategies

Inspect inbound PDFs at the mail and web gateway for Circle annotations combined with Cloudy /BE dictionaries and out-of-range geometric parameters.
Alert on Foxit executables spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe, which is atypical for document rendering.
Correlate application crash telemetry with recent PDF opens to identify targeted exploitation attempts.

Monitoring Recommendations

Forward endpoint process, file, and crash telemetry to a centralized analytics platform for cross-host correlation.
Monitor for anomalous outbound network connections initiated by Foxit processes immediately after a PDF is opened.
Track patch compliance for Foxit PDF Editor and Reader across the fleet using software inventory data.

How to Mitigate CVE-2026-91804

Immediate Actions Required

Update Foxit PDF Editor and Foxit Reader to the fixed versions listed in the vendor advisory.
Restrict opening of PDF files from untrusted senders until patching is complete.
Enforce least-privilege user accounts so that exploitation does not yield administrative rights.

Patch Information

Foxit has published fixes through its security bulletin process. Consult the Foxit Security Bulletins page for the specific patched builds addressing CVE-2026-91804 and apply them across all Windows, macOS, and Linux installations.

Workarounds

Disable the rendering of annotations or open untrusted PDFs in the application's Safe Reading Mode where supported.
Configure email and web gateways to sandbox or strip PDF attachments containing annotation dictionaries from unknown senders.
Route high-risk PDF workflows through an isolated viewer or browser-based renderer until patches are deployed.

bash

# Example: block execution of unpatched Foxit binaries via AppLocker until updates are applied
New-AppLockerPolicy -RuleType Publisher -User Everyone `
  -FilePath "C:\Program Files\Foxit Software\Foxit PDF Editor\FoxitPDFEditor.exe" `
  -Action Deny