CVE-2026-91809: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2026-91809 is a use-after-free vulnerability in Foxit PDF Editor/Reader that occurs when processing malformed PDF form fields. This flaw can cause application crashes through improper memory access. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-91809 Overview

CVE-2026-91809 is a use-after-free vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the application's handling of malformed PDF form fields. Improper validation during field-name traversal causes the application to access a released object, resulting in an application crash or potential code execution in the context of the current user.

Exploitation requires a user to open a crafted PDF document, aligning with a local attack vector and user interaction requirement. The weakness is classified under [CWE-416] Use After Free.

Critical Impact
A crafted PDF can trigger memory corruption in Foxit PDF Editor/Reader, leading to application crash and potential arbitrary code execution under the current user context.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Specific affected versions listed in the Foxit Security Bulletins

Discovery Timeline

2026-09-23 - CVE-2026-91809 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91809

Vulnerability Analysis

The vulnerability occurs while Foxit PDF Editor/Reader traverses form field names inside a PDF document. When the parser encounters a malformed field structure, it fails to correctly validate object lifetimes during traversal. The application subsequently dereferences a pointer to an object that has already been released.

Accessing freed memory produces undefined behavior. In practice this results in an application crash. Under favorable heap conditions, an attacker who controls the contents that reoccupy the freed allocation can influence program flow and achieve arbitrary code execution in the user's context.

Root Cause

The root cause is improper validation during PDF form field-name traversal, tracked as [CWE-416] Use After Free. The parser retains and reuses a reference to a form field object after that object has been freed. There is no lifetime check before the dereference, so a crafted field hierarchy is sufficient to reach the vulnerable code path.

Attack Vector

The attack requires local delivery of a crafted PDF document combined with user interaction. A victim must open the malicious file in a vulnerable version of Foxit PDF Editor or Foxit PDF Reader. Typical delivery mechanisms include email attachments, drive-by downloads, and shared file repositories. No elevated privileges are required to trigger the flaw. Successful exploitation impacts confidentiality, integrity, and availability of the affected host.

No public proof-of-concept has been referenced in the NVD entry, and CISA has not listed the issue in the Known Exploited Vulnerabilities catalog at this time.

Detection Methods for CVE-2026-91809

Indicators of Compromise

Unexpected termination of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF attachment.
Windows Error Reporting (WER) or application crash events referencing Foxit processes with access violation exceptions.
PDF files containing unusually deep or malformed AcroForm field hierarchies delivered through email or web downloads.

Detection Strategies

Monitor process telemetry for Foxit reader processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Alert on Foxit process crashes correlated with recent PDF file opens from Outlook, browsers, or messaging clients.
Inspect PDF documents at the mail gateway for anomalous /AcroForm structures with recursive or malformed /T (field name) entries.

Monitoring Recommendations

Enable EDR telemetry on user endpoints to capture module loads, memory allocations, and exceptions inside Foxit processes.
Aggregate application crash events into the SIEM and baseline normal Foxit crash frequency to detect anomalies.
Track PDF file provenance from download source through open event to enable post-incident file retrieval and analysis.

How to Mitigate CVE-2026-91809

Immediate Actions Required

Upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed versions identified in the Foxit Security Bulletins.
Inventory all endpoints running Foxit software and prioritize systems handling PDFs from external sources.
Instruct users to avoid opening PDF attachments from unverified senders until patches are deployed.

Patch Information

Foxit publishes remediation details and fixed builds through its security bulletins portal. Review the Foxit Security Bulletins for the specific advisory addressing CVE-2026-91809, then deploy the updated installer using your standard software distribution channel.

Workarounds

Disable JavaScript and form processing features in Foxit PDF Editor/Reader preferences to reduce exposure to malicious form fields.
Enable Safe Reading Mode to restrict actions performed by untrusted PDF documents.
Route inbound PDFs through a content disarm and reconstruction (CDR) or sandbox detonation gateway before delivery to users.
Restrict the default handler for PDF files on high-risk systems until patching is complete.

bash

# Example: Query installed Foxit versions across Windows endpoints via PowerShell
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'Foxit*' } |
  Select-Object Name, Version, InstallDate