EUVD-2026-85117
GHSA-wjh9-8m64-vcfh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malformed image soft-mask data
-
DeliveryDeliver file to victim (email/download)
-
ExploitVictim opens PDF in Foxit
-
ExecutionArithmetic underflow triggers OOB read during image parsing
-
ImpactApplication crash and minor heap memory disclosure
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open a specially crafted PDF in Foxit PDF Editor or Foxit PDF Reader that contains an image with malformed soft-mask data whose data attribute is not properly validated, causing an arithmetic underflow during image parsing. Limiting factors: the attack is local file-based (AV:L) and requires user interaction (UI:R) - the victim must actually open the malicious document; no authentication is needed (PR:N) but there is no network-remote or automatic trigger. Impact is capped at an application crash plus limited memory disclosure; there is no code execution or data modification path described. |
| Impact | This is a genuine but LOW-priority issue. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, base 6.1) describes a client-side, file-parsing bug: the attacker cannot reach it over a network - the victim must locally open a crafted PDF (AV:L + UI:R). The CWE-125 heap out-of-bounds READ (from arithmetic underflow on the soft-mask data attribute) is consistent with the low confidentiality/high availability split: C:L reflects at most a small adjacent-heap memory disclosure, and A:H reflects the described application crash (DoS). There is NO integrity impact (I:N), consistent with a read primitive rather than a write/corruption bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The only reference is a generic Foxit security-bulletins landing page with no version, patch, or EPSS/KEV data. Net: a real, vendor-confirmed defect but of limited severity - the ceiling is a crash plus a minor info leak, gated behind user interaction. Note the 'Buffer Overflow' tag is a misnomer: this is an out-of-bounds read, not an overflow/write. |
| Exploit ScenarioDerived | An attacker crafts a PDF containing an image with malformed soft-mask data whose attribute triggers an arithmetic underflow during image parsing, then delivers it via email or a download link. When the victim opens the file in Foxit PDF Editor or Reader, the parser reads past the intended heap buffer, crashing the application and potentially exposing a small amount of adjacent heap memory. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Opening a specially crafted PDF in Foxit PDF Reader or Foxit PDF Editor can trigger an arithmetic underflow while the application parses an image soft-mask, leading to a heap-based out-of-bounds read that discloses limited memory contents and terminates the application in a crash. The attack is file-based and requires the victim to open the malicious document (AV:L, UI:R); no authentication is needed (PR:N), but there is no network-remote or automatic trigger, and the impact is capped at a crash plus limited information disclosure rather than code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuine but low-priority issue for most environments.
RemediationAI
No vendor-released patch was identified at time of analysis, so no exact fix version can be cited; the single reference provided is Foxit's security bulletin index (https://www.foxit.com/support/security-bulletins.html), which should be monitored for the build number that addresses this soft-mask parsing defect, and the reader should be updated by internal update or manual installer as soon as that build is published. Until then, treat PDFs as untrusted input: strip or quarantine PDF attachments at the mail and web gateway and block direct download of PDFs from untrusted sources; where untrusted PDFs must be inspected, open them in a sandboxed, low-privilege container or a hardened virtual machine rather than on the analyst workstation, accepting that this adds latency and cannot guarantee the viewer's rendering fidelity. Consider removing Foxit as the default handler for .pdf files on high-risk endpoints so documents open in a browser-based viewer or an alternate renderer that runs with reduced privileges - a trade-off in user experience and document-fidelity for forms, JavaScript and signing workflows. Run the product with reduced privileges or inside an application sandbox/AppContainer where feasible, enable automatic crash-reporting or EDR process-crash telemetry so attempts to exploit the underflow (repeated reader crashes on a specific document) are detected, and note that JavaScript-disabling options such as safe reading modes do not mitigate this issue because the trigger is image soft-mask parsing rather than script execution. None of these controls eliminate the flaw; they only reduce the likelihood that a user opens a weaponized document before a fixed build is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based out-of-bounds read (CWE-125) in Foxit's PDF image-parsing path, specifically in the handling of soft-mask (SMask) image data used by the PDF transparency model. In PDF, an image XObject may carry a soft-mask dictionary whose attributes describe the mask's color space, matte, transfer function and associated data; when Foxit processes a malformed soft-mask attribute, insufficient validation of a size or offset value causes an arithmetic underflow (a subtraction that wraps to a very large unsigned value or negative index). That wrapped value is then used in a bounds calculation for a heap buffer, so the reader reads past the end of the allocated region, returning adjacent heap memory in the best case (partial information disclosure, CVSS C:L) and faulting the process in the worst case (A:H). The impact is constrained by the CVSS vector AV:L/PR:N/UI:R, i.e. the attacker must deliver the file locally and convince a user to open it, and there is no described path to memory corruption, code execution or data modification. The affected CPE entries cover Foxit PDF Editor and Foxit PDF Reader from Foxit Software Inc., supplied as wildcard (any-version) strings, so the vulnerability should be assumed to affect currently shipping builds until the vendor's security bulletin identifies the exact fixed releases.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Local crafted-file parsing needing the victim to open it (AV:L/UI:R), no auth (PR:N); OOB read yields minor leak (C:L) and crash (A:H), no write (I:N).
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.
Zero Day Initiative Advisories
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB