Foxit PDF Reader CVE-2026-91801

Exploitation requires the victim to open (or preview) an attacker-crafted PDF containing embedded resources with maliciously-constructed file paths in Foxit PDF Editor or Reader; the traversal occurs during the application's handling of these embedded PDF resources. This is a local attack vector with no authentication required (PR:N) but mandatory user interaction (UI:R) - the single greatest limiting factor, as the attacker cannot trigger it without the user opening the document. There is no network-facing or default-service exposure; risk is bounded to users who process untrusted PDFs. Escalation to code execution is described as conditional, so real-world impact may be limited to an arbitrary file-write primitive unless a viable write target enables execution.

This is a client-side, file-parsing vulnerability rather than a remotely-reachable server flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) correctly models a local attack vector requiring user interaction: the victim must open a maliciously-crafted PDF in Foxit. PR:N means no authentication is needed, but UI:R (open the document) is the dominant limiting factor. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automatable exploitation - this reads as a responsibly-disclosed, vendor-reported (Foxit) issue rather than an in-the-wild threat. The RCE outcome is described conditionally ('potentially enabling arbitrary code execution'), so the confirmed primitive is an out-of-intended-location file write (path traversal) that may escalate to code execution; treat the C:H/I:H/A:H as the worst-case ceiling. Net: a genuinely serious desktop RCE candidate given Foxit's large install base, but current exploitation-probability signals are absent/low, making this a patch-on-normal-cycle priority absent evidence of weaponization.

An attacker crafts a PDF whose embedded resource file paths use traversal sequences and delivers it via email, a download link, or a shared drive. When the victim opens or previews the document in Foxit PDF Editor/Reader, the insufficiently-validated resource path causes a file to be written outside its intended directory, which can be leveraged to achieve arbitrary code execution in the user's context. No public exploit code was identified at time of analysis.