What is the CVSS score of CVE-2026-91802?

CVE-2026-91802 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-91802?

Within 24 hours, confirm which endpoints and business units run Foxit PDF Editor or Foxit PDF Reader, verify the installed build numbers against Foxit's security advisory and support pages, and push an internal advisory telling users not to open PDFs from untrusted or unexpected senders; where Foxit is not business-critical, temporarily set the default PDF handler to an alternative hardened reader and disable automatic WebP rendering or browser-based PDF preview where configurable. Within 7 days, deploy email and web gateway rules that quarantine or sandbox PDF attachments containing embedded WebP objects, apply application allow-listing or endpoint detection and response blocking on Foxit spawning child processes or making unusual network connections, and confirm that exploit-protection features (such as Microsoft Defender Exploit Guard or equivalent ASLR/DEP/CET enforcement) are enabled for foxitreader.exe and foxitpdfeditor.exe; monitor Foxit's advisory channel daily for a fixed build. Within 30 days, if Foxit has released a patched version, pilot and roll it out enterprise-wide with verification reporting, and if no patch has shipped, formalize the interim posture by restricting Foxit to a vetted user group, requiring all incoming PDFs from external sources to be rendered in a sandboxed or converted form, and adding a recurring review of the risk with a documented decision on whether to migrate to an alternative PDF platform.

Foxit PDF Editor/Reader CVE-2026-91802

EUVD-2026-85120 MEDIUM

Out-of-bounds Write (CWE-787)

2026-09-23 Foxit

GHSA-vm9v-2x45-2rm4

Buffer Overflow Memory Corruption Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

5.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious WebP-embedded PDF
Delivery

Deliver via email or download link
Exploit

Victim opens file in Foxit
Execution

Trigger heap OOB write in WebP decoder
Impact

Corrupt memory / crash application

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a victim to open or render an attacker-controlled PDF containing a crafted WebP image whose bitmap stride and target buffer format are manipulated to trigger the OOB write in Foxit's WebP decoding path (UI:R). It is local/client-side (AV:L): the attacker must deliver the file and rely on the user opening it in Foxit PDF Editor or Reader - there is no server-side or network-listening component. No application authentication is needed (PR:N), but the user-interaction and file-delivery requirement is the primary limiting factor, along with dependence on the specific vulnerable Foxit versions.
Impact	This is a client-side, file-format parsing memory-corruption bug (CWE-787 heap out-of-bounds write in WebP decoding) requiring local access and user interaction: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8). PR:N here means no application authentication is required, but exploitation is NOT remote-unauthenticated in the network sense - the AV:L/UI:R combination means a victim must open or render an attacker-supplied PDF (or embedded WebP), so real-world risk is gated on social engineering rather than mass remote scanning. There is a notable conflict between the vendor CVSS impact (C:H/I:H/A:H, implying arbitrary code execution) and the description, which states only that 'successful exploitation could result in an application crash' (availability impact) - verify with Foxit whether code execution is actually achievable, as OOB writes are frequently exploitable but this advisory scopes impact to a crash. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation; this reads as a routine hardening/patch-now-on-cycle client vulnerability rather than an emergency, despite the 7.8 score.
Exploit ScenarioDerived	An attacker crafts a malicious PDF (or a document embedding a malformed WebP image) with manipulated bitmap stride/target-buffer format fields and delivers it via email or a download link. When the victim opens the file in Foxit PDF Editor/Reader, the WebP decoder performs a heap out-of-bounds write, corrupting memory and at minimum crashing the application (potential for code execution per the CVSS impact metrics). No public exploit code was identified in the provided data.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Heap-based out-of-bounds write in Foxit PDF Editor/Reader allows attackers to corrupt memory when a victim opens a PDF containing a crafted WebP image, potentially leading to code execution or a crash. The flaw stems from improper handling of bitmap stride and target buffer formats (CWE-787) and requires user interaction to open the malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or active exploitation has been identified at time of analysis.

RemediationAI

Patch available per vendor advisory: apply the latest update from Foxit's security bulletins page (https://www.foxit.com/support/security-bulletins.html) to address CVE-2026-91802. Because no exact fixed version is provided in the input data, consult the advisory for the precise patched release. Until patching is possible, avoid opening PDFs from untrusted sources or containing unknown WebP images; if your deployment allows, consider disabling WebP image rendering within Foxit, though this may break legitimate documents. Deploying exploit mitigation technologies such as ASLR and DEP can make exploitation harder but do not eliminate the vulnerability. No public exploit code or active exploitation has been identified, so the immediate risk is lower, but timely patching remains the primary defense.

Affected VersionsENISA

Foxit PDF Reader Versions 2026.2 and earlier

Foxit PDF Editor Versions 14.0.7 and earlier

Foxit PDF Editor Versions 2026.2 and earlier

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability resides in Foxit's WebP image decoding implementation, specifically in how it handles bitmap stride (the number of bytes per row of a bitmap) and target buffer formats. When a crafted WebP image embedded in a PDF is parsed, mismatched stride or format calculations cause a heap-based out-of-bounds write (CWE-787). The affected products are Foxit PDF Editor and Foxit PDF Reader, as indicated by CPE strings cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*:*:*:*:*:*:*:*. WebP is a modern image format developed by Google, and PDF documents can embed such images; Foxit's decoder fails to properly validate buffer size expectations when converting or rendering the WebP data.

Know when Foxit Pdf Editor gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Foxit) PRIMARY HIGH

NVD 5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 7.8 HIGH

AV:L/UI:R because the victim must open a malicious file; PR:N as no app auth is needed; impact retained at C:H/I:H/A:H per vendor for the OOB write, though the description confirms only a crash.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Oct 08, 2026 - 14:07 NVD

HIGH MEDIUM

CVSS changed

Oct 08, 2026 - 14:07 NVD

7.8 (HIGH) 5.5 (MEDIUM)

CVE Published

Sep 23, 2026 - 07:50 cve.org

HIGH 7.8

DescriptionNVD

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash.

Executive ViewAI

Why It Matters

A high-severity memory-corruption vulnerability in Foxit PDF Editor and Foxit PDF Reader can let an attacker run code on a user's machine when that user opens a PDF carrying a crafted WebP image, a routine action in most document-heavy workflows. Any employee who opens such a file - whether received by email, downloaded from the web, or pulled from a shared repository - could be affected, making this a broad endpoint risk wherever Foxit is the default PDF application. Exploitation requires the user to open the file, and no public exploit code has been identified at time of analysis, so this is a near-term exposure to manage rather than an active incident, but the absence of a vendor patch means the organization cannot close it through routine patching alone.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: route all externally sourced PDF attachments through email/web sandboxing or detonation before delivery; block or strip embedded WebP image objects from inbound PDFs at the gateway; enable exploit-mitigation features (ASLR, DEP, CFG/CET, Microsoft Defender Exploit Guard or equivalent) for Foxit executables; restrict Foxit to users with a genuine business need and set an alternative hardened PDF reader as default elsewhere; disable browser and mail-client in-line PDF preview so files open only in the standalone application; apply application allow-listing and monitor for Foxit spawning unexpected child processes; maintain user awareness guidance against opening unsolicited PDFs; track Foxit's advisory feed for a fixed build and apply it immediately once released.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

High

Foxit is among the most widely deployed PDF reader/editor alternatives to Adobe

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.