Foxit PDF Editor/Reader CVE-2026-91791

Exploitation requires the victim to open an attacker-supplied, specially crafted PDF in Foxit PDF Editor or Reader (AV:L, UI:R). The malicious file must contain JavaScript that triggers a reentrant execution condition via page-visibility events, so PDF JavaScript execution must be enabled in the reader (a common default). The use-after-free is reached while the application calculates annotation boundaries against a released page-view object. Limiting factors: user interaction is mandatory (no drive-by without the victim opening the file), the attack is local rather than network-remote, and the confirmed outcome per the description is an application crash rather than code execution or data theft.

This is a client-side memory-safety issue (CWE-416 use-after-free) in Foxit PDF Editor/Reader, self-reported by Foxit. The provided CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8, HIGH), reflecting local attack vector with required user interaction (opening a crafted PDF). SIGNAL CONFLICT: the description states the flaw causes 'an invalid memory read and application crash' - an availability-only (DoS) outcome - yet the vendor CVSS asserts full C:H/I:H/A:H, and the tags themselves lead with 'Denial Of Service.' The described primitive (a read of a released page-view object, ending in a crash) does not by itself establish confidentiality or integrity compromise; the C:H/I:H scoring appears to reflect the theoretical ceiling of the use-after-free class rather than the demonstrated impact. Treat the demonstrated impact as DoS unless Foxit clarifies exploitability into information disclosure or code execution. On the deployment side, EPSS is not provided, the CVE is NOT in CISA KEV, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: real-world priority is moderate. It requires the victim to open a malicious file (UI:R) and, per the description, JavaScript reentrancy triggered by page-visibility events, so exploitation is user-gated and the confirmed impact is a crash. Prioritize patching due to the product's very large install base, but do not treat the C:H/I:H claim as a confirmed data-loss/RCE risk without vendor corroboration.

An attacker emails or hosts a specially crafted PDF containing JavaScript that manipulates page-visibility events to force reentrant execution. When the victim opens the file in Foxit PDF Editor/Reader, the application accesses an already-freed page-view object while computing annotation boundaries, causing an invalid read and a crash. No public proof-of-concept is referenced, and exploitation requires local file-open with user interaction (AV:L/UI:R).