What is the CVSS score of CVE-2026-91799?

CVE-2026-91799 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-91799?

Within 24 hours, disable JavaScript execution in Foxit PDF Editor and Foxit PDF Reader across all endpoints via Group Policy or configuration management, and instruct users to avoid opening PDFs from untrusted sources. Within 7 days, deploy application isolation or sandboxing for Foxit products where feasible, and ensure endpoint detection and response (EDR) tools are configured to detect and block suspicious PDF-related process behavior. Within 30 days, conduct a risk assessment to determine if alternative PDF viewers can be used for high-risk users, and monitor Foxit's security advisories for an official patch, applying it immediately once available.

Foxit PDF Reader CVE-2026-91799

EUVD-2026-85124 HIGH

Use After Free (CWE-416)

2026-09-23 Foxit

GHSA-r5mq-pm4h-fg98

RCE Use After Free Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · Vendor: Foxit

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious PDF with JS array logic
Delivery

Deliver PDF via email or web
Exploit

Victim opens file in Foxit
Execution

Trigger use-after-free during array processing
Persist

Corrupt heap and hijack control flow
Impact

Execute code as current user

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to open a specially crafted PDF in a vulnerable version of Foxit PDF Editor or Reader, and requires the application's JavaScript execution to be enabled (the flaw is in JavaScript array-object handling). The mandatory user interaction (UI:R) and the need for attacker-controlled heap state to turn the use-after-free into code execution rather than a mere crash are the primary limiting factors; there is no network-service exposure and no privilege prerequisite (PR:N) beyond luring a user to open the file. Disabling PDF JavaScript in Foxit's preferences mitigates the trigger path.
Impact	This is a client-side memory-corruption flaw (CWE-416 use-after-free) with a plausible but not established real-world risk. The vendor CVSS is 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - the AV:L reflects that exploitation is local in the sense that a user must open a malicious file on their own machine, and UI:R confirms victim interaction (opening/rendering a crafted PDF) is mandatory. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' The high C:H/I:H/A:H impact is standard for a UAF that can yield arbitrary code execution, but the description itself hedges ('potentially resulting in ... arbitrary code execution'), meaning weaponization is not confirmed. No conflicting signals are present; the vector is internally consistent with a file-parsing/JavaScript-engine bug. Net: a genuine but not urgent patch-priority item - treat as important for endpoints that routinely open untrusted PDFs, not as an actively-exploited emergency. Note only the vendor advisory bulletin URL is provided, with no specific fixed version, so patch details must be verified against Foxit's security bulletin.
Exploit ScenarioDerived	An attacker emails or hosts a specially crafted PDF whose embedded JavaScript manipulates array objects to trigger access of a freed object during array processing. When the victim opens the document in a vulnerable Foxit PDF Editor or Reader (with JavaScript enabled), the use-after-free corrupts memory, causing a crash or, with a controlled heap layout, arbitrary code execution in the user's context. No public exploit code is referenced, and successful RCE requires reliable heap grooming.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption while the application processes JavaScript array objects, potentially crashing the viewer or achieving arbitrary code execution in the context of the logged-on user. Exploitation is client-side only: the attacker must lure a victim into opening a malicious PDF with JavaScript execution enabled in the product (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and there is no privilege prerequisite or network-service exposure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; turning the use-after-free into reliable code execution additionally depends on attacker-controlled heap state, which is the principal limiting factor beyond the mandatory user interaction.

RemediationAI

No vendor-released patch or exact fixed version was identified in the provided data for CVE-2026-91799; the sole reference is Foxit's security bulletin index at https://www.foxit.com/support/security-bulletins.html, which should be consulted to obtain the build number that addresses this JavaScript array use-after-free, after which Foxit PDF Editor and Foxit PDF Reader should be updated to that release or later, with version verification performed after deployment. Because the vulnerable path is JavaScript array-object handling, the most effective compensating control is to disable PDF JavaScript: in Foxit, open File > Preferences > JavaScript and clear 'Enable JavaScript Actions', then restart the application - this removes the trigger path and is consistent with the assessment that disabling PDF JavaScript mitigates the flaw, but it will break scripted/interactive PDF forms, calculations, and validation logic, so it is best combined with an allow-list for a small number of trusted document sources. Additional hardening worth applying while awaiting the fix: enable Protected View or read-only/trusted-mode restrictions so documents from untrusted locations cannot execute active content, disable the Trust Manager's automatic trust of documents from non-approved locations, remove Foxit as the default PDF handler on high-risk endpoints, educate users not to open PDFs from unsolicited email or untrusted web sources (the attack requires user interaction), and run the reader with least privilege so that any successful exploitation cannot escalate to administrative rights. Browser-embedded and plugin-based PDF rendering should also be disabled where possible, since a crash or corruption in the embedded viewer carries the same client-side risk.

Affected VersionsENISA

Foxit PDF Reader Versions 2026.2 and earlier

Foxit PDF Editor Versions 2026.2 and earlier

Foxit PDF Editor Versions 13.2.6 and earlier

Foxit PDF Editor Versions 14.0.7 and earlier

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a use-after-free (CWE-416) inside Foxit's JavaScript engine, specifically in the handling of JavaScript array objects. During array processing, an object that has already been released is dereferenced, so the application reads or writes memory whose ownership has changed; depending on heap layout and attacker grooming, this manifests either as a crash (denial of service) or as a controllable memory-corruption primitive that can be leveraged for code execution. The affected components are Foxit's client PDF readers/editors, identified by the CPEs cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader, both listed with unconstrained version ranges, so any version prior to the vendor's fixed build is presumed vulnerable. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the local, client-initiated attack model: the malicious content is delivered as a file, no authentication or account privilege is required, scope remains unchanged, and impact to confidentiality, integrity, and availability is high once exploitation succeeds. Because the trigger path is JavaScript array-object handling, disabling JavaScript execution in the product removes the vulnerable code path entirely, and the need to control freed-memory reuse is why real-world weaponization is plausible rather than demonstrated.

Know when Foxit Pdf Editor gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Foxit) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local file-open vector (AV:L) with required user interaction (UI:R) and no privileges; a UAF enabling code execution justifies full C/I/A high impact, matching the vendor vector.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.

Executive ViewAI

Why It Matters

Foxit PDF Editor and Foxit PDF Reader, widely used for document workflows, contain a high-severity memory corruption vulnerability (CVE-2026-91799) that remains unpatched; no vendor-released patch identified at time of analysis. An attacker could exploit this by enticing a user to open a specially crafted PDF, potentially leading to arbitrary code execution and compromise of the user's system and data. With no public exploit identified at time of analysis, the immediate risk is moderate, but the potential organizational impact-including data loss, ransomware, and productivity disruption-warrants urgent mitigation.

Business Impact: High

Compensating Controls

Disable JavaScript execution in Foxit PDF Editor and Foxit PDF Reader; apply application isolation or sandboxing; enforce least privilege for users; monitor vendor advisory for patch release.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

High

Foxit is a widely deployed enterprise and consumer PDF reader/editor alternative to Adobe

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.