CVE-2026-91805: Foxit PDF Use-After-Free Vulnerability

CVE-2026-91805 Overview

CVE-2026-91805 is a use-after-free vulnerability [CWE-416] in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the PDF page-tree handling logic. A crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects. Successful exploitation leads to memory corruption and an application crash, with potential for arbitrary code execution in the context of the current user.

Exploitation requires local user interaction, such as opening a malicious PDF document. No public proof-of-concept or in-the-wild exploitation has been reported at publication time.

Critical Impact
A crafted PDF opened in Foxit PDF Editor or Reader can corrupt memory through freed page objects, potentially enabling arbitrary code execution under the current user's privileges.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91805 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91805

Vulnerability Analysis

The vulnerability exists in Foxit PDF Editor and Reader's PDF page-tree handling code. A PDF document's page tree is a hierarchical structure that organizes page objects and their associated resources. When the application renders a page, it holds references to page objects allocated on the heap.

A specially crafted PDF can trigger structural modifications to the page tree while rendering is in progress. These modifications cause the application to release page objects that are still referenced by ongoing rendering operations. Subsequent access to the released memory constitutes a use-after-free condition.

Memory corruption follows when the freed allocation is reused by another object. An attacker who controls the layout of the freed region can influence program flow, escalating the impact from a crash to arbitrary code execution in the process context.

Root Cause

The root cause is missing lifetime enforcement on page-tree objects during document rendering. The application does not synchronize object destruction with active rendering references, permitting freed memory to be dereferenced. This is a classic [CWE-416] Use After Free pattern.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted PDF through email, web download, network share, or removable media. When the victim opens the file in a vulnerable Foxit PDF Editor or Reader build, the page-tree manipulation triggers the freed-object access during rendering. No elevated privileges are required for the attacker; exploitation runs at the privilege level of the user opening the document.

Technical details on the specific page-tree operations and object types involved are not published. See the Foxit Security Bulletins for vendor analysis.

Detection Methods for CVE-2026-91805

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF document
Windows Error Reporting entries referencing access violations in Foxit modules during PDF page rendering
PDF files from untrusted sources containing anomalous or deeply nested page-tree structures
Child processes spawned by Foxit executables that do not match expected application behavior

Detection Strategies

Monitor endpoint telemetry for Foxit process crashes correlated with recently opened PDF attachments
Inspect email and web gateway logs for PDF attachments delivered from untrusted senders or domains
Alert on suspicious child processes created by Foxit binaries, such as command shells or script interpreters
Apply YARA rules that identify malformed PDF page-tree constructs delivered to endpoints

Monitoring Recommendations

Track process-creation events where the parent is a Foxit executable and the child is cmd.exe, powershell.exe, or rundll32.exe
Collect crash dumps from user endpoints for post-incident analysis of exploitation attempts
Log file-write activity by Foxit processes to detect payload staging in user-writable directories
Correlate PDF download events with subsequent process anomalies on the same host within a short window

How to Mitigate CVE-2026-91805

Immediate Actions Required

Identify all endpoints running Foxit PDF Editor or Foxit PDF Reader and inventory installed versions
Apply the vendor-supplied patch as soon as it is available from the Foxit Security Bulletins
Restrict opening of PDF files received from untrusted or external sources until patching is complete
Enable application sandboxing and exploit protection features for PDF readers on managed endpoints

Patch Information

Foxit publishes fixed versions and remediation guidance through the Foxit Security Bulletins. Administrators should consult the bulletin for the exact patched version numbers and deployment procedures. Enterprise deployments should use centralized software distribution tools to accelerate rollout across all endpoints.

Workarounds

Configure the operating system to open PDFs in a hardened default handler such as a browser sandbox until the Foxit update is deployed
Disable PDF preview handlers in email clients and file explorers to prevent automatic rendering of untrusted documents
Enforce Attack Surface Reduction rules and Windows Defender Exploit Guard policies to limit process spawning by Foxit binaries
Block inbound PDF attachments from external senders at the email gateway for high-risk user groups

bash

# Example: Enumerate Foxit installations across Windows endpoints via PowerShell
Get-CimInstance -ClassName Win32_Product | \
  Where-Object { $_.Name -like 'Foxit*PDF*' } | \
  Select-Object Name, Version, InstallDate