Foxit PDF Editor CVE-2026-91805

Exploitation requires a victim to open an attacker-crafted PDF in Foxit PDF Editor or Reader; the malicious file must induce a page-structure change during rendering that frees a page object still in use (the page-tree handling flaw). Limiting factors: mandatory user interaction (UI:R) to open the file, local attack vector (AV:L - no remote/network-triggered path), and no authentication needed on the victim's side. There is no special product configuration required - it affects default document-rendering behavior - but the attack depends entirely on social engineering the user into opening the file.

This is a client-side file-parsing use-after-free (CWE-416) in Foxit PDF Editor/Reader. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) is the standard 'open a malicious document' profile: local attack vector because the victim must open a file, no privileges required, but mandatory user interaction (UI:R). Note a discrepancy worth flagging: the vendor rates full C:H/I:H/A:H impact (implying code execution is achievable, which is plausible for a controllable UAF), yet the description itself only claims 'memory corruption and an application crash' (i.e., a DoS). The impact metrics reflect worst-case exploitability rather than what the text demonstrates - verify with Foxit whether reliable code execution is confirmed. On real-world signals: no EPSS score is provided, there is no CISA KEV listing, and no public POC is referenced (only the vendor security-bulletins index). So despite the 7.8 'High' rating, there is no evidence of active exploitation or a weaponized exploit at this time; risk is gated behind social-engineering a user into opening a crafted PDF. This is a real patch-worthy issue for a widely-deployed reader, but not an emergency drop-everything item absent exploitation evidence.

An attacker emails or hosts a specially crafted PDF that mutates its page-tree structure during rendering; when a victim opens it in Foxit PDF Reader/Editor, the application accesses freed page objects, corrupting memory and crashing (with potential for code execution in the app's context). No public exploit code is identified at time of analysis, and exploitation requires the user to open the malicious file (UI:R).