What is the CVSS score of CVE-2026-91808?

CVE-2026-91808 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.2%.

Foxit PDF Reader CVE-2026-91808

EUVD-2026-85165 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-23 Foxit

GHSA-gqv8-m8qw-cgrc

Windows Buffer Overflow Information Disclosure Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

6.1

CVSS 3.1 · Vendor: Foxit

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft PDF with inconsistent image compression metadata
Delivery

Deliver file to victim (email/download)
Exploit

Victim opens PDF in Foxit
Execution

Undersized buffer allocated during image decode
Persist

Out-of-bounds read on render
Impact

Application crash / minor memory disclosure

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to open a specially crafted PDF in Foxit PDF Editor or Foxit PDF Reader in which an image object's compression metadata is inconsistent with the actual image data, triggering the flawed image-decode/render path. Limiting factors: the attack is local/client-side (AV:L) and requires user interaction (UI:R) - the attacker must deliver the file and the victim must open it; no authentication is required by the application (PR:N) but there is no network-reachable exploitation. The realistic outcome is an application crash with possible minor memory disclosure, not remote code execution.
Impact	The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, base 6.1 MEDIUM) describes a client-side file-parsing bug: 'local' attack vector because the attacker cannot reach the parser over a network but must get a crafted PDF onto the victim's machine, combined with UI:R (the victim must open the file). The vendor-assigned impact - low confidentiality (a heap OOB read may expose small amounts of adjacent process memory), no integrity, and high availability (the described outcome is an application crash) - is internally consistent and I agree with it. This is realistically a DoS/limited-info-leak primitive rather than a code-execution flaw; the description explicitly caps the outcome at 'application crash' with no mention of a controllable write. EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is referenced (only a generic Foxit security bulletin). There are no signals of active exploitation. Net: a genuine but moderate-priority client-side bug - patch in normal cycles, not an emergency. Note a labeling conflict: the input Tag 'Buffer Overflow' overstates a CWE-125 out-of-bounds READ (no overflow/write is described), so do not treat this as memory-corruption/RCE class.
Exploit ScenarioDerived	An attacker crafts a PDF containing an image object whose declared compression metadata is inconsistent with its actual data, then delivers it via email or a malicious download and social-engineers the victim into opening it in Foxit PDF Editor/Reader. During image decoding an undersized buffer is allocated and the renderer reads out of bounds, crashing the application (and potentially disclosing small amounts of adjacent heap memory). No public exploit code is identified at time of analysis, and exploitation requires user interaction (opening the file).

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a crafted PDF contains image objects whose compression metadata is inconsistent with the actual image data, causing an undersized buffer and a crash during rendering. The flaw has a CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning an unauthenticated local attacker must deliver a malicious PDF and convince a user to open it; the realistic outcome is application crash with possible minor memory disclosure, not remote code execution. No public exploit identified at time of analysis, and no active exploitation is reported in the provided data.

RemediationAI

Apply the fix from Foxit's security bulletins page at https://www.foxit.com/support/security-bulletins.html; the provided data does not name an exact patched version, so update Foxit PDF Editor and Foxit PDF Reader to the newest release listed there. Because exploitation requires the victim to open a malicious PDF, reduce exposure by blocking untrusted PDF attachments at email and web gateways, training users not to open unexpected PDFs, and opening untrusted documents only in a restricted viewer or OS-level sandbox (e.g., Windows Defender Application Guard or a macOS sandboxed PDF viewer) - with the trade-off that sandboxing may break PDF features such as embedded scripts or external links. If immediate patching is not possible, consider using an alternative PDF reader for untrusted files and enforcing application allowlisting to limit the blast radius of a crash; these controls do not fix the underlying parsing flaw and are only temporary compensating measures.

Affected VersionsENISA

Foxit PDF Editor Versions 14.0.7 and earlier

Foxit PDF Editor Versions 13.2.6 and earlier

Foxit PDF Reader Versions 2026.2 and earlier

Foxit PDF Editor Versions 2026.2 and earlier

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-125 (Out-of-bounds Read) in Foxit's PDF image-decoding path. When a PDF image object declares compression metadata that does not match the actual encoded image data, the decoder allocates a buffer sized from the metadata but then reads beyond that buffer while rendering the image. The affected CPE entries (cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*) use wildcard versions, indicating the issue applies broadly to Foxit PDF Editor and Foxit PDF Reader releases prior to whichever fix Foxit publishes; the vendor's security bulletins page is the authoritative source for exact version boundaries. Because the bug is a read, not a write, it primarily causes denial of service via crash and may leak a small amount of adjacent heap memory, consistent with the CVSS impact ratings A:H and C:L; it does not provide a direct code-execution primitive per the available data.

Know when Foxit Pdf Editor gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Foxit) PRIMARY 6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

vuln.today AI 6.1 MEDIUM

Client-side PDF parse: AV:L and UI:R because the victim must open a crafted file; OOB read yields C:L (minor leak) and A:H (crash), with no write so I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

DescriptionCVE.org

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.

Zero Day Initiative Advisories

ZDI-26-737 Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability Sep 2026

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

High

Foxit is a leading Adobe Acrobat alternative, widely deployed on enterprise and consumer desktops

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +30

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.