CVE-2026-91811: Foxit PDF Editor/Reader Buffer Overflow

CVE-2026-91811 Overview

CVE-2026-91811 is a heap-based out-of-bounds write vulnerability in the Product Representation Compact (PRC) parser used by Foxit PDF Editor and Foxit PDF Reader. The flaw stems from insufficient validation of vertex indices in triangular fan texture meshes embedded in PRC data. An attacker who convinces a user to open a crafted PDF file can trigger memory corruption and an application crash. Successful exploitation may also lead to arbitrary code execution in the context of the current user. The vulnerability is tracked under CWE-787: Out-of-bounds Write.

Critical Impact
Opening a malicious PDF containing crafted PRC mesh data can corrupt heap memory in Foxit PDF Editor/Reader, resulting in application crashes and potential local code execution.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91811 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91811

Vulnerability Analysis

The vulnerability resides in the PRC parser component of Foxit PDF Editor and Reader. PRC is a 3D data format that can be embedded within PDF documents to represent CAD models and 3D geometry. When the parser processes a triangular fan texture mesh, it fails to properly validate vertex indices supplied by the file. A crafted PRC stream can supply indices that exceed the bounds of the allocated vertex buffer on the heap. The parser then writes attacker-influenced data outside of that buffer, corrupting adjacent heap memory.

Exploitation requires user interaction — the victim must open a malicious PDF file. Because the write occurs on the heap and involves attacker-controlled data, an attacker who can shape the heap layout may convert the corruption into arbitrary code execution under the privileges of the user running the application.

Root Cause

The root cause is missing or insufficient bounds checking on vertex index values when reconstructing triangular fan mesh geometry from PRC input. The parser trusts the file-supplied indices and uses them directly as offsets into a fixed-size heap buffer, satisfying the conditions for CWE-787.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted PDF containing malicious PRC 3D data through email, a web download, a network share, or another file-delivery channel. When the target opens the file in a vulnerable Foxit PDF Editor or Reader build, the PRC parser processes the mesh and triggers the out-of-bounds write. No authentication is required on the target system.

No public proof-of-concept code is currently associated with this CVE. See the Foxit Security Bulletins for authoritative technical details.

Detection Methods for CVE-2026-91811

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF containing 3D content.
Windows Error Reporting or Application event log entries citing access violations or heap corruption in the Foxit process.
Inbound PDF files that contain PRC 3D streams originating from untrusted senders or web sources.

Detection Strategies

Inspect PDF attachments for embedded PRC 3D annotations and flag files from untrusted sources for sandbox detonation.
Correlate Foxit process crashes with recent PDF open events across endpoint telemetry to identify potential exploitation attempts.
Deploy YARA or content-inspection rules on mail and web gateways to identify PDFs containing suspicious PRC mesh structures.

Monitoring Recommendations

Monitor process creation and crash events for Foxit PDF Editor and Reader binaries, and alert on repeated abnormal terminations.
Track child process spawning from the Foxit application, which would indicate post-exploitation activity such as command shells or scripting hosts.
Log endpoint file-write activity from Foxit processes to detect payload staging following a successful exploit.

How to Mitigate CVE-2026-91811

Immediate Actions Required

Apply the fixed Foxit PDF Editor and Reader versions listed in the Foxit Security Bulletins as soon as they are available in your environment.
Restrict opening of PDFs from untrusted sources, and route unknown attachments through a sandbox before user access.
Enable exploit mitigations such as ASLR, DEP, and CFG on endpoints running Foxit products to raise the cost of heap exploitation.

Patch Information

Foxit publishes patched builds through its security advisory portal. Consult the Foxit Security Bulletins page for the specific versions of Foxit PDF Editor and Foxit PDF Reader that remediate CVE-2026-91811, and deploy the fixed release across all affected endpoints.

Workarounds

Disable 3D content rendering in Foxit PDF Editor/Reader preferences to prevent the PRC parser from processing untrusted mesh data.
Configure application allowlisting to block execution of child processes spawned by Foxit binaries.
Use a hardened, alternative PDF viewer for handling PDFs received from untrusted external sources until patches are deployed.

bash

# Example: block outbound child-process execution from Foxit via WDAC/AppLocker policy
# (Pseudocode — validate in a test ring before production rollout)
New-AppLockerPolicy -RuleType Path \
  -User Everyone \
  -Action Deny \
  -Path "%ProgramFiles%\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe" \
  -Condition ChildProcess