CVE-2026-91817: Foxit PDF Buffer Overflow Vulnerability

CVE-2026-91817 Overview

CVE-2026-91817 is a heap-based out-of-bounds read vulnerability in Foxit PDF Editor and Foxit Reader. The flaw resides in the application's handling of wide strings within embedded PDF JavaScript. Insufficient validation of string-deletion ranges triggers an integer underflow, causing the parser to read memory outside the intended heap allocation. The condition results in an application crash and possible disclosure of adjacent memory contents. The vulnerability is classified under [CWE-125] (Out-of-bounds Read) and requires user interaction, such as opening a crafted PDF document.

Critical Impact
A crafted PDF containing malicious embedded JavaScript can crash Foxit PDF Editor/Reader and potentially leak heap memory to an attacker.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91817 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91817

Vulnerability Analysis

The vulnerability affects Foxit's wide-string handling routines invoked by embedded PDF JavaScript. When JavaScript inside a PDF requests deletion of a range of characters from a wide string, the deletion logic fails to properly validate the requested range boundaries. An attacker can supply values that cause the internal length calculation to wrap around, producing an unexpectedly large size value. The subsequent read operation then traverses memory beyond the boundaries of the allocated wide-string buffer on the heap.

The read operation returns adjacent heap data that may contain sensitive process memory. In most cases, the malformed access terminates the process. The attack requires local access, meaning the target user must open a crafted PDF document. No privileges are required to construct or deliver the payload.

Root Cause

The root cause is an integer underflow in the string-deletion range validation logic. When the calculated deletion length exceeds the current string length, the arithmetic wraps into a large unsigned value. This value is then used as the bound for a subsequent read, producing an out-of-bounds read on the heap-allocated wide-string buffer.

Attack Vector

An attacker crafts a PDF document containing embedded JavaScript that invokes wide-string manipulation with malformed deletion range parameters. The victim opens the document in a vulnerable Foxit PDF Editor or Reader build. The JavaScript engine processes the string operation, triggers the underflow, and reads past the allocated buffer. The result is a denial-of-service condition through application termination, with potential secondary impact on heap memory disclosure.

Detailed proof-of-concept information is not publicly available. See the Foxit Security Bulletins for vendor-provided technical details.

Detection Methods for CVE-2026-91817

Indicators of Compromise

Unexpected crashes of FoxitPDFReader.exe or FoxitPDFEditor.exe shortly after opening a PDF
Windows Error Reporting entries referencing access violations in Foxit binaries during JavaScript execution
PDF documents delivered via email or download that embed JavaScript performing wide-string manipulation

Detection Strategies

Inspect inbound PDF attachments for embedded JavaScript that manipulates string ranges with abnormal parameters
Correlate Foxit application crashes with recent file-open events sourced from untrusted origins
Deploy behavioral endpoint monitoring to flag Foxit processes that terminate abnormally after opening documents from email or web downloads

Monitoring Recommendations

Enable process-crash telemetry on endpoints running Foxit PDF Editor and Reader
Log PDF file provenance, including download source and email sender, for forensic correlation
Monitor for suspicious child processes spawned by Foxit binaries as a defense-in-depth measure

How to Mitigate CVE-2026-91817

Immediate Actions Required

Update Foxit PDF Editor and Reader to the latest available version as listed in the vendor security bulletin
Restrict opening of PDFs from untrusted or unknown sources until patching is complete
Disable JavaScript execution within Foxit PDF applications where the feature is not required

Patch Information

Foxit publishes fixed versions and remediation guidance through the Foxit Security Bulletins page. Administrators should identify the affected build in their environment and apply the vendor-released update.

Workarounds

Disable JavaScript in Foxit PDF Editor/Reader via Preferences > JavaScript > Enable JavaScript Actions (uncheck the option)
Enforce Safe Reading Mode to limit execution of active content within PDF documents
Route inbound PDFs through a content disarm and reconstruction (CDR) gateway that strips embedded JavaScript

bash

# Configuration example: disable JavaScript in Foxit via Windows registry (per-user)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Editor\Preferences\JavaScript" /v bJSEnable /t REG_DWORD /d 0 /f