CVE-2026-91808: Foxit PDF Editor Buffer Overflow Vulnerability

CVE-2026-91808 Overview

CVE-2026-91808 is a heap-based out-of-bounds read vulnerability in Foxit PDF Editor Reader. The flaw resides in the application's handling of PDF image objects that contain inconsistent compression metadata. Insufficient validation during image decoding produces an undersized buffer, and the renderer reads past the allocated region during rasterization. Successful exploitation causes an application crash, resulting in denial of service for the user session.

The issue is classified under [CWE-125: Out-of-bounds Read]. Exploitation requires a local attack vector and user interaction, meaning a victim must open a crafted PDF file for the condition to trigger.

Critical Impact
A crafted PDF can force Foxit PDF Editor Reader to read beyond a heap buffer during image decoding, crashing the application and potentially exposing adjacent process memory.

Affected Products

Foxit PDF Editor Reader (specific version ranges not enumerated in the NVD entry)
Refer to the Foxit Security Bulletin for authoritative version details

Discovery Timeline

2026-09-23 - CVE-2026-91808 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91808

Vulnerability Analysis

The vulnerability resides in the image decoding path of Foxit PDF Editor Reader. PDF image XObjects declare stream metadata that describes the encoded pixel data, including filter chain, bit depth, color components, and dimensions. When these metadata fields are inconsistent with the actual compressed stream, the decoder can allocate a buffer smaller than the pixel data the renderer subsequently reads.

During rendering, the code advances a pointer through the heap allocation and processes bytes based on the declared image geometry. Because the allocation was undersized relative to the traversal length, the read continues past the end of the buffer into adjacent heap memory. The out-of-bounds access produces unpredictable pixel output and, more importantly, triggers an access violation when the read crosses an unmapped page boundary.

Root Cause

The root cause is missing cross-validation between declared image metadata and decoded stream size. The decoder trusts the compression metadata when sizing its intermediate buffer instead of reconciling it against the decoded output length. This is a classic instance of [CWE-125] where boundary computation for a heap allocation diverges from the boundary used during subsequent access.

Attack Vector

An attacker crafts a PDF containing an image object with mismatched compression metadata and delivers it through email, a download link, or a shared file location. The victim opens the file in a vulnerable Foxit PDF Editor Reader build. When the application renders the image, the out-of-bounds read executes and the process terminates.

The vulnerability requires local access and user interaction, and impacts availability. Information disclosure is possible in limited scenarios where adjacent heap contents influence rendered output before the crash occurs. See the Foxit Security Bulletin for vendor analysis.

Detection Methods for CVE-2026-91808

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF
Windows Error Reporting (WER) entries referencing access violations in Foxit image decoding modules
PDF files containing image XObjects with declared dimensions or filter parameters that do not match the decoded stream length

Detection Strategies

Monitor endpoint telemetry for Foxit process termination events correlated with recent PDF open activity
Inspect email and web gateway logs for PDF attachments delivered from untrusted senders that trigger downstream crash telemetry
Use PDF static analysis tooling to flag image objects whose /Width, /Height, /BitsPerComponent, and /Filter parameters produce buffer sizes inconsistent with the embedded stream

Monitoring Recommendations

Enable crash dump collection on endpoints running Foxit PDF Editor Reader to support forensic triage
Alert on repeated Foxit application crashes from the same user or file source, which may indicate targeted exploitation attempts
Track installed Foxit versions across the fleet to identify hosts running builds predating the vendor fix

How to Mitigate CVE-2026-91808

Immediate Actions Required

Inventory all endpoints running Foxit PDF Editor or Foxit Reader and identify unpatched installations
Apply the vendor security update referenced in the Foxit Security Bulletin as soon as it is available
Instruct users to avoid opening PDF attachments from untrusted or unverified senders until patches are deployed

Patch Information

Foxit publishes fixes through its security bulletin portal. Administrators should consult the Foxit Security Bulletin for the specific product build that addresses CVE-2026-91808 and follow the vendor's upgrade procedure for enterprise deployments.

Workarounds

Configure email gateways to sandbox or detonate inbound PDF attachments before delivery
Restrict PDF rendering to a hardened alternative or a browser-based viewer for untrusted documents until patching completes
Enforce application-level exploit mitigations such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) on hosts running Foxit

bash

# Query installed Foxit version on Windows endpoints via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Foxit*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation