CVE-2026-91806: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2026-91806 Overview

CVE-2026-91806 is a use-after-free vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw exists in the application's handling of PDF form fields. Embedded JavaScript can reference form-field objects after they have been released, causing memory corruption and an application crash. Successful exploitation requires a user to open a malicious PDF document. The issue is tracked under CWE-416: Use After Free.

Critical Impact
An attacker who convinces a user to open a crafted PDF can trigger memory corruption in Foxit PDF Editor/Reader, potentially leading to arbitrary code execution in the context of the current user.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for exact affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91806 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91806

Vulnerability Analysis

The vulnerability resides in the PDF form-field subsystem of Foxit PDF Editor and Reader. PDF documents can embed JavaScript that interacts with interactive form fields such as text boxes, buttons, and signature fields. When a form field is released from memory, references to that field remain accessible to the executing script. Subsequent access dereferences a dangling pointer, producing undefined behavior.

The immediate observable effect is an application crash, consistent with denial of service. However, use-after-free conditions of this class frequently allow attackers to control the freed allocation, enabling arbitrary code execution in the user context. Exploitation requires user interaction — the victim must open the malicious PDF — and attacker complexity is low.

Root Cause

The root cause is missing lifetime management between the JavaScript engine and the form-field object graph. The application releases the underlying form-field structure while script-visible references still exist. When JavaScript later accesses the field, the memory allocator may have reassigned the region to attacker-influenced data.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a PDF containing form fields and embedded JavaScript designed to free a field and then re-access it. Delivery typically occurs through phishing email attachments, drive-by downloads, or malicious file shares. Once the victim opens the document in a vulnerable Foxit build, the use-after-free triggers automatically.

No verified public exploit code is available. See the Foxit Security Bulletins for vendor technical details.

Detection Methods for CVE-2026-91806

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe correlated with recently opened PDF files
Windows Error Reporting (WER) entries referencing access violations in Foxit modules
PDF files containing embedded JavaScript that manipulates form-field references and calls removeField() followed by field access
Inbound emails or downloads delivering PDF attachments from untrusted senders

Detection Strategies

Inspect PDF attachments at the mail gateway for /JavaScript, /JS, and /AcroForm objects combined with field-removal APIs
Monitor endpoint telemetry for Foxit processes spawning unexpected child processes such as cmd.exe or powershell.exe
Alert on Foxit process crashes with exception codes 0xC0000005 (access violation) shortly after PDF file opens
Correlate PDF file writes to user download directories with subsequent Foxit process launches

Monitoring Recommendations

Enable process creation and command-line logging on endpoints running Foxit products
Forward Foxit application logs and WER crash data to a central SIEM for correlation
Track file-write events for .pdf files originating from browsers or mail clients
Baseline normal Foxit behavior to surface anomalous memory-related crashes and unusual module loads

How to Mitigate CVE-2026-91806

Immediate Actions Required

Inventory all systems running Foxit PDF Editor and Foxit PDF Reader
Apply the latest Foxit security updates as listed in the vendor bulletin
Block or quarantine PDF attachments from untrusted senders at the email gateway
Instruct users to avoid opening unsolicited PDF documents until patching is complete

Patch Information

Foxit publishes fixed versions in its security bulletins. Consult the Foxit Security Bulletins for the specific patched build addressing CVE-2026-91806 and deploy it across all managed endpoints.

Workarounds

Disable JavaScript execution in Foxit PDF Editor/Reader via Preferences > JavaScript > Enable JavaScript Actions until patches are applied
Enable Safe Reading Mode to restrict active content in PDF files
Use application allowlisting to prevent Foxit processes from launching unexpected child processes
Route PDF previewing through a sandboxed viewer or browser-native renderer for untrusted documents

bash

# Configuration example: disable JavaScript in Foxit via Windows registry
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JSPrefs" /v "bEnableJS" /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JSPrefs" /v "bEnableJS" /t REG_DWORD /d 0 /f