CVE-2026-91810: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2026-91810 Overview

CVE-2026-91810 is a heap-based out-of-bounds read vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the application's handling of malformed PDF image masks. Inconsistent image metadata causes incorrect alpha-channel processing during rendering, leading to reads past the intended heap buffer boundary. Successful exploitation causes the application to crash, resulting in denial of service. Exploitation requires a user to open a crafted PDF document locally. The issue is classified under CWE-125: Out-of-bounds Read.

Critical Impact
A crafted PDF can trigger an out-of-bounds heap read during image mask rendering, crashing Foxit PDF Editor/Reader and potentially disclosing adjacent heap memory contents.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Specific version ranges: Not Available (refer to Foxit Security Bulletins)

Discovery Timeline

2026-09-23 - CVE-2026-91810 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91810

Vulnerability Analysis

The vulnerability affects the PDF rendering pipeline in Foxit PDF Editor and Reader. When the parser processes a PDF containing an image with a mask object, it reads metadata describing the image dimensions, color components, and alpha channel layout. A malformed PDF supplies inconsistent metadata between the image and its associated mask.

During rendering, the alpha-channel processing routine uses the declared dimensions to compute memory offsets without validating them against the actual buffer size. This causes the routine to read bytes past the end of the allocated heap buffer. The out-of-bounds read produces undefined behavior and typically results in an application crash.

Exploitation requires local access and user interaction. An attacker must convince a victim to open a crafted PDF file. The primary observed impact is availability loss through process termination. Adjacent heap memory contents may also be exposed through the read, though the CVSS vector rates confidentiality impact as low.

Root Cause

The root cause is missing validation of image mask metadata before its use in pointer arithmetic during alpha-channel rendering. The renderer trusts the width, height, and stride values declared in the PDF stream dictionaries. When these values are inconsistent with the actual mask buffer, offset calculations produce addresses outside the allocation.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a PDF file containing an image mask with intentionally inconsistent metadata. The attacker delivers the file through email, a web download, or a shared drive. When the victim opens the document in a vulnerable version of Foxit PDF Editor or Reader, the rendering engine processes the malformed mask and triggers the out-of-bounds read.

The vulnerability is not remotely exploitable without user action. No public proof-of-concept or in-the-wild exploitation has been reported. See the Foxit Security Bulletins for vendor-specific technical details.

Detection Methods for CVE-2026-91810

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF document
Windows Error Reporting or Application Event Log entries citing access violations in Foxit rendering modules
PDF files containing image XObjects with mask streams whose declared dimensions do not match the mask data length

Detection Strategies

Monitor endpoint telemetry for Foxit process crashes correlated with recent PDF file opens from email or browser downloads
Inspect inbound PDFs at email and web gateways for malformed image mask structures using PDF-aware content inspection
Correlate application crash events with parent process activity to identify potential exploitation attempts

Monitoring Recommendations

Enable crash telemetry collection on endpoints running Foxit PDF products and forward events to a centralized SIEM
Track PDF file provenance metadata to identify documents originating from untrusted external sources
Alert on repeated Foxit process terminations across multiple users, which may indicate a targeted campaign

How to Mitigate CVE-2026-91810

Immediate Actions Required

Inventory all endpoints running Foxit PDF Editor or Foxit PDF Reader and identify versions in use
Apply the vendor-provided patch as published in the Foxit Security Bulletins
Restrict opening of PDF files received from untrusted or unverified sources until patches are deployed
Educate users on the risk of opening unsolicited PDF attachments

Patch Information

Foxit publishes fixes for image parsing vulnerabilities through its security bulletin portal. Administrators should consult the Foxit Security Bulletins for the specific fixed versions of Foxit PDF Editor and Foxit PDF Reader that address CVE-2026-91810 and deploy them through standard patch management workflows.

Workarounds

Configure email and web gateways to strip or quarantine PDF attachments from untrusted senders
Use an alternate PDF viewer with sandboxing enabled for opening PDFs from external sources
Disable PDF preview features in email clients and file explorers to prevent automatic rendering
Enforce application allowlisting policies that limit which processes can be spawned by the PDF viewer

bash

# Example: Query installed Foxit versions on Windows endpoints via PowerShell
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Foxit*" } | Select-Object Name, Version