Foxit PDF Reader CVE-2026-91792

Exploitation requires the victim to open a specially crafted PDF in Foxit PDF Editor or Reader with JavaScript execution active, where the malicious file uses page- and annotation-related JavaScript actions to trigger reentrant zoom and layout operations. Limiting factors: the attack is local (AV:L) and requires user interaction (UI:R) - the attacker cannot trigger it remotely without the user opening the document - and it depends on the application's JavaScript engine being enabled (disabling PDF JavaScript is a mitigation). No authentication is involved (PR:N) because exploitation happens in the context of whoever opens the file.

This is a client-side memory-corruption flaw whose real-world risk is moderate and gated by user interaction, not a mass-exploitation candidate. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U) is internally consistent with a file-parsing bug: 'local' attack vector because the malicious PDF must be delivered to and opened on the victim's machine, and UI:R because the victim must open it. The vendor rates full C:H/I:H/A:H (7.8), but the description itself only demonstrates a use-after-free leading to an 'application crash' - i.e. only an availability impact is actually evidenced. UAF primitives are frequently escalatable to code execution, so the C:H/I:H rating is plausible-but-unproven from the text alone; this is a notable conflict between the demonstrated impact (crash/DoS, reinforced by the 'Denial Of Service' tag) and the claimed confidentiality/integrity impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no signal of active or imminent exploitation. Net: a legitimate patch-worthy client vulnerability, but lower operational priority than a remote unauthenticated server flaw, and it depends entirely on social-engineering a user into opening a crafted document.

An attacker emails or hosts a specially crafted PDF containing page- and annotation-related JavaScript actions that trigger reentrant zoom and layout operations. When the victim opens the file in Foxit PDF Editor/Reader, the JavaScript forces access to page objects after they are freed, producing a use-after-free that at minimum crashes the application and potentially could be developed into code execution. No public proof-of-concept is identified in the provided data.