CVE-2026-91815: Foxit PDF Editor/Reader RCE Vulnerability

CVE-2026-91815 Overview

CVE-2026-91815 is a heap-based out-of-bounds write vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the JPEG2000 image decoding routine, which fails to sufficiently validate image metadata embedded in PDF files. An attacker who convinces a user to open a crafted PDF can trigger memory corruption during decoding. Successful exploitation can crash the application and may lead to arbitrary code execution in the context of the logged-in user. The issue is tracked under CWE-787: Out-of-bounds Write.

Critical Impact

A malicious PDF containing crafted JPEG2000 metadata can corrupt heap memory in Foxit PDF Editor/Reader, enabling arbitrary code execution as the current user.

Affected Products

• Foxit PDF Editor
• Foxit PDF Reader
• Refer to the Foxit Security Bulletins for exact affected version ranges

Discovery Timeline

• 2026-09-23 - CVE-2026-91815 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91815

Vulnerability Analysis

The vulnerability exists in the JPEG2000 image parser used by Foxit PDF Editor and Reader. When the decoder processes a PDF containing an embedded JPEG2000 (JPX/JP2) stream, it reads metadata fields that describe image dimensions, tile layout, and code-block structure. Insufficient validation of these values allows the decoder to compute an undersized heap allocation while writing a larger volume of decoded pixel data. The mismatch produces a heap out-of-bounds write [CWE-787].

Heap corruption of this kind commonly overwrites adjacent allocator metadata or object pointers. Depending on heap state and allocation reuse, an attacker can steer subsequent writes to hijack control flow. The attack requires local file interaction and user action to open the crafted PDF, which aligns with the low-complexity, user-interaction requirement described in the vulnerability record.

Root Cause

The decoder trusts JPEG2000 metadata such as tile size, component count, and code-block parameters without enforcing bounds against the allocated output buffer. When these fields are manipulated, the decoding loop writes past the end of the heap chunk sized from the untrusted metadata.

Attack Vector

An attacker crafts a PDF that embeds a malformed JPEG2000 image and delivers it via email, chat, a download link, or a shared file store. When a user opens the document in a vulnerable version of Foxit PDF Editor or Reader, the parser decodes the image and triggers the out-of-bounds write. No network exposure of the application is required.

No public proof-of-concept is currently listed in the enriched data. Technical specifics of the vulnerable routine are described in the Foxit Security Bulletins.

Detection Methods for CVE-2026-91815

Indicators of Compromise

• Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF, especially with access-violation exceptions in image-decoding modules.
• PDF files with embedded JPEG2000 (/Filter /JPXDecode) streams originating from untrusted senders or newly registered domains.
• Child processes spawned by Foxit processes (for example, cmd.exe, powershell.exe, or rundll32.exe) following the opening of a document.

Detection Strategies

• Inspect PDF attachments at the email gateway for /JPXDecode filters combined with malformed JPEG2000 headers.
• Monitor endpoint telemetry for heap corruption signals such as Windows Error Reporting entries tagged to Foxit binaries.
• Correlate document-open events with subsequent process creation, network egress, or persistence writes from Foxit processes.

Monitoring Recommendations

• Enable Windows Defender Exploit Guard or equivalent memory-protection telemetry for Foxit processes.
• Ingest Foxit application crash logs into the SIEM and alert on repeated crashes across multiple hosts.
• Track file provenance metadata (Mark-of-the-Web) to prioritize investigations on PDFs delivered from the internet.

How to Mitigate CVE-2026-91815

Immediate Actions Required

• Update Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the Foxit Security Bulletins.
• Restrict opening of PDFs from untrusted sources until patches are deployed across the fleet.
• Verify that endpoint protection is configured to block child-process creation from PDF readers where feasible.

Patch Information

Foxit publishes fixed builds through its security advisory portal. Administrators should consult the Foxit Security Bulletins for the exact patched version corresponding to CVE-2026-91815 and deploy through standard software distribution tooling.

Workarounds

• Configure Foxit PDF Editor/Reader to disable JavaScript and limit trusted-mode features to reduce post-exploitation options.
• Use application allowlisting to prevent Foxit processes from launching interpreters or shells.
• Route inbound PDFs through a content disarm and reconstruction (CDR) gateway that normalizes or removes JPEG2000 streams.

# Example: block child process creation from Foxit binaries via WDAC/AppLocker
# (Illustrative policy fragment - validate before production deployment)
New-AppLockerPolicy -RuleType Publisher -User Everyone `
  -RuleNamePrefix "BlockFoxitChildProc" `
  -Action Deny -FilePath "C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe"