Foxit PDF Editor CVE-2026-91788

Exploitation requires the victim to open a crafted PDF that is loaded as a TRUSTED document (elevated JavaScript privilege) in Foxit PDF Editor/Reader, AND a second sensitive PDF must be open concurrently within the SAME application process for the cross-document read to succeed - the vulnerability is that Foxit's JavaScript interface omits the spec-required attribute authorization checks. Limiting factors: local attack vector (no network reachability), mandatory user interaction (opening the file), and high attack complexity from the trusted-document state plus the requirement that a target document already be loaded in-process; there is no memory corruption, so impact is confined to reading and exfiltrating document content.

This is a genuine but modest-priority issue best characterized as a high-CVSS-impact-but-constrained-real-risk flaw. The vendor CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N = 4.7 Medium) is internally consistent and I agree with it: the confidentiality impact is legitimately High (cross-document sensitive-content theft and external exfiltration), but multiple limiting factors keep the base score in the Medium band - Local attack vector (client-side file parsing, not network-reachable), High attack complexity (a second sensitive document must be open in the same process and the malicious PDF must run as a 'trusted' document with elevated JavaScript privileges), and required User Interaction (victim must open the malicious PDF). Integrity and availability are correctly N - this is pure information disclosure. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation; the only reference is Foxit's generic security-bulletins.html landing page with no version-specific advisory. The conditions are conflicting only in the sense that PR:N (unauthenticated) coexists with a 'trusted PDF' precondition - but 'trusted' here is a document-privilege state, not an authentication credential, so PR:N is defensible. Net: real but low-urgency; patch on normal cycle rather than emergency.

An attacker crafts a PDF that is opened as a trusted document and embeds JavaScript that skips the specification-mandated attribute authorization checks to reach into another sensitive PDF the victim has open in the same Foxit process, reading its content and posting it to an attacker-controlled endpoint. Exploitation is local and requires the victim to open the malicious file while a second sensitive document is loaded, and the attack complexity is high. No public proof-of-concept was identified in the provided data.