EUVD-2026-85128
GHSA-m5j8-prg6-375j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malformed color space
-
DeliveryDeliver file to victim via email/web
-
ExploitVictim opens PDF in Foxit
-
ExecutionTrigger out-of-bounds write in renderer
-
ImpactExecute code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted PDF containing malformed color space data in Foxit PDF Editor or Foxit PDF Reader (UI:R - user interaction is mandatory). There is no network-service attack surface; the attacker relies on social engineering or file delivery. Limiting factors: the target must run an affected Foxit version, must open the malicious document, and code execution is only 'potential' (the confirmed outcome is a crash). No authentication is needed and no special non-default configuration is required - default installations that render PDFs are affected. |
| Impact | This is a client-side memory-corruption flaw (CWE-787 out-of-bounds write) in the PDF rendering engine of Foxit PDF Editor/Reader, triggered by malformed color space data. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent for a file-parsing bug: AV:L reflects that the attacker delivers a malicious file rather than exploiting a network service directly, UI:R captures the requirement that the victim open the crafted PDF, and C:H/I:H/A:H reflect the potential for full code execution in the user's context. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no evidence of active exploitation or weaponized exploit code - the RCE outcome is described by both the vendor and CWE as 'potentially' achievable, meaning the confirmed impact today is a crash/DoS with plausible-but-unproven code execution. Real-world priority is moderate: the product is very widely deployed, which raises exposure, but exploitation is gated on user interaction and there is no exploitation signal, so this is a patch-in-normal-cycle item rather than an emergency. Note the vendor's single generic security-bulletin reference provides no fixed version, so patch specifics must be verified directly with Foxit. |
| Exploit ScenarioDerived | An attacker crafts a PDF with malformed color space data and delivers it via email, a download link, or a web page; when the victim opens it in Foxit PDF Editor/Reader, the parser performs an out-of-bounds write during rendering, crashing the application and potentially allowing code execution in the user's security context. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to open the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.
RemediationAI
Apply the fixed Foxit PDF Editor and Foxit PDF Reader builds listed on the vendor's security bulletins page (https://www.foxit.com/support/security-bulletins.html), which is the only authoritative source for the exact patched version numbers corresponding to CVE-2026-91794; the available data does not pin a specific fix version, so verify the release notes or the product's Help > About build number against that bulletin rather than relying on generic "upgrade to latest" guidance. Until a patched build is deployed, the most effective compensating control is to prevent untrusted PDFs from reaching the renderer: enable Safe Reading Mode / Trust Manager so that JavaScript and non-embedded-file actions are blocked and prompts appear before risky content is processed, which reduces the chance of reaching the malformed color-space path at the cost of extra prompts and disabled dynamic content for legitimate documents. For high-risk or fully untrusted documents, open them inside a sandbox or disposable VM (Windows Defender Application Guard, a container, or a converted-to-image pipeline) so that a successful out-of-bounds write cannot escape into the host session; the trade-off is limited printing, clipboard, and file-system integration. Organizations that cannot upgrade immediately should route inbound PDFs through a content-disarm-and-reconstruction or PDF-to-image conversion gateway that rebuilds documents with sanitized color space objects, restrict the file types accepted from external email/web sources, and consider blocking the opening of PDFs from untrusted origins on hosts that must retain the vulnerable version. Note that endpoint AV/EDR may catch only known exploit patterns, so it should be treated as a detection layer, not a substitute for patching; after upgrading, re-verify that the deployment actually replaced the vulnerable binary in all installed copies, since side-by-side or MSI-updated installs can leave stale versions behind.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the document-parsing/rendering pipeline that Foxit products use to interpret PDF color space objects - the structures (ICCBased, Separation, DeviceN, Indexed and their tint-transform functions/arrays) that tell a renderer how to map color component values into device colors before rasterization. The vendor reports insufficient consistency and boundary validation when such malformed color space data is processed, so a crafted object can drive a write past the end of an allocated buffer, which is the classic CWE-787 out-of-bounds write class and a memory-corruption primitive rather than a logic error. Because the write occurs inside the renderer while the document is being opened and rendered, the corruption is reachable on any machine where a user opens untrusted PDFs with an affected build. The CPE data identifies the impacted codebases as Foxit Software Inc. Foxit PDF Editor and Foxit PDF Reader (both mapped with wildcard version selectors, i.e., no fixed version is pinned in the CPE), so the affected surface is effectively the entire installed base of these two products unless and until a patched build is applied. The local attack vector (AV:L) reflects that the malicious PDF must be delivered to and opened on the target - there is no remotely reachable service component - while PR:N in the vector indicates no authentication or special privileges are needed on the victim host and the default configuration is sufficient to reach the vulnerable parsing path.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing bug so AV:L with UI:R (victim opens crafted PDF), no privileges needed, and full C/I/A impact from potential code execution in the user's context.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and Foxit PDF Reader are affected by a high-severity out-of-bounds write vulnerability (CVE-2026-91794) that can be triggered when a user opens a specially crafted PDF. Successful exploitation could crash the application and potentially allow an attacker to execute code with the user's privileges, leading to data compromise or lateral movement. No vendor patch is currently available and no public exploit has been identified at time of analysis, but the attack requires user interaction and local file delivery, making user awareness and application isolation critical.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict opening PDFs from untrusted sources, enable application sandboxing where available, and ensure users operate with least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading t
Exploit-DB