Foxit PDF Editor/Reader CVE-2026-91789

Exploitation requires the victim to open an attacker-crafted PDF in Foxit PDF Editor or Reader that embeds a malicious U3D 3D model or GIF image whose texture dimension/size metadata is manipulated to force an incorrectly sized allocation. Limiting factors: mandatory user interaction (UI:R - the victim must open the document), the local delivery/processing model (AV:L), and the requirement that the specific U3D/GIF texture-decoding code path be reached during rendering. The description's 'under certain conditions' qualifier suggests the OOB write is not triggered by all malformed textures, which may further constrain reliable exploitation. No authentication is required against the application itself (PR:N).

This is a genuine high-priority client-side memory-corruption flaw, though not an emergency at time of analysis. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) is internally consistent for a file-parsing bug: AV:L reflects that the malicious PDF must be delivered to and opened on the victim's machine (the file itself is the local attack surface), and UI:R correctly captures the required victim action of opening the document. The CWE-787 out-of-bounds write with a mis-sized allocation is a classic exploitable primitive, and the description's 'potentially resulting in remote code execution' supports the full C:H/I:H/A:H impact ceiling. However, several exploitation signals are MISSING: no EPSS score is provided, the CVE is NOT listed in CISA KEV, and no public exploit code is referenced - the only reference is Foxit's generic security-bulletins.html landing page with no version data, patch identifier, or technical writeup. So while the technical ceiling (RCE) is high, there is no evidence of real-world exploitation and no confirmed PoC, placing realistic near-term risk below what the 7.8 alone implies. Note the AV:L designation is standard for PDF-parsing CVEs but can be misread as 'requires local login' - it does not; a remote attacker delivers the file (email/web) and the local vector reflects that processing happens on the victim host.

An attacker crafts a PDF containing a malicious U3D 3D object or embedded GIF texture with manipulated image-dimension/size fields, then delivers it via phishing email or a web download. When the victim opens the document in Foxit PDF Editor or Reader, the texture decoder allocates an undersized buffer and writes attacker-controlled pixel data out of bounds, corrupting memory and potentially yielding code execution in the application's context. No public proof-of-concept is referenced, so exploitation would currently require independent development of a working exploit.