EUVD-2026-85164
GHSA-p8qq-w67f-qxj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malformed image mask
-
DeliveryDeliver file to victim
-
ExploitVictim opens PDF in Foxit
-
ExecutionMalformed metadata triggers bad alpha-channel processing
-
PersistHeap out-of-bounds read
-
ImpactMemory leak and application crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted PDF in Foxit PDF Editor or Foxit PDF Reader that contains a malformed image mask whose image metadata is inconsistent with its actual pixel/alpha data, triggering incorrect alpha-channel processing during rendering. Limiting factors: mandatory user interaction (UI:R - the victim must open the file), local vector (AV:L - no remote/network-triggered path), and the impact ceiling is a crash plus limited memory read rather than code execution. No authentication or special non-default configuration is required beyond the target simply rendering the document. |
| Impact | This is a moderate-severity client-side memory-safety issue whose real-world priority is low-to-moderate despite the 6.1 CVSS. The vendor vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) is internally consistent with a file-parsing bug: AV:L plus UI:R correctly models the requirement that a victim open a crafted PDF locally, and the dominant impact is availability (A:H, application crash) with only a minor confidentiality leak (C:L) from the out-of-bounds read. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no signal of active exploitation or automatability - exploitation status is therefore 'no public exploit identified at time of analysis.' The stated CWE-125 (OOB read) and the description ('read ... and application crash') cap the realistic worst case at DoS plus limited memory disclosure, unlike sibling Foxit bugs that reach RCE. Net: a real but non-urgent bug - patch on the normal cycle. The only mild conflict worth verifying is the two-sided impact framing: the 'Information Disclosure' tag and C:L imply data leakage, while the description emphasizes a crash - the OOB read supports both but neither is severe. |
| Exploit ScenarioDerived | An attacker crafts a PDF with a malformed image mask whose metadata is inconsistent with its actual data, then delivers it via email or a web link. When the victim opens it in Foxit PDF Editor/Reader, alpha-channel processing during rendering reads past the heap allocation, leaking a small amount of adjacent memory and crashing the application. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a user opens a crafted PDF containing a malformed image mask whose metadata is inconsistent with its actual pixel and alpha data, causing incorrect alpha-channel processing during rendering and resulting in an application crash with a limited read of adjacent heap memory. The issue is local and requires user interaction - the victim must open the file - with no authentication required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, score 6.1), and the impact ceiling is denial of service plus minor information exposure rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and the CVE is not listed in CISA KEV; CPE data marks both Foxit PDF Editor and Foxit PDF Reader as affected across all versions.
RemediationAI
Patch status is not confirmed from the available data - no fixed version number is supplied in the input, so the primary action is to consult Foxit's security bulletins page at https://www.foxit.com/support/security-bulletins.html, identify the build that addresses CVE-2026-91810, and upgrade Foxit PDF Editor and Foxit PDF Reader to that release or later; do not assume an arbitrary 'latest' download is equivalent without verifying the build against the bulletin. Until the fixed build is deployed, reduce exposure with concrete compensating controls: turn on Foxit's Protected Mode / Safe Reading Mode (sandboxing and write restrictions on untrusted documents) and leave it enabled, accepting that it can break some interactive document features and cross-document links; disable JavaScript execution and automatic opening of embedded files for untrusted PDFs, with the trade-off that script-driven forms will not function; and route untrusted PDFs through an isolated or disposable environment (VM, AppContainer, or a low-privilege account) so a crash and any leaked heap bytes stay contained, at the cost of extra user friction. Because the trigger is rendering of a malicious file, gate delivery with mail and web content filtering that strips or quarantines PDFs from unknown senders, and monitor for Foxit crash reports as a possible indicator of attempted exploitation. No public exploit code or active exploitation has been identified at time of analysis, so these measures are precautionary rather than incident-driven.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-125 out-of-bounds read in the PDF image-mask (soft mask / SMask) rendering path of Foxit's PDF engine. PDF image masks carry their own dimensions, bit depth, decoding parameters, and colour-space metadata that must be internally consistent with the associated image XObject's pixel and alpha data; when an attacker supplies inconsistent metadata, the renderer computes an incorrect offset or length while processing the alpha channel and reads past the end of a heap buffer. Because the vector is local and requires the victim to render the document (AV:L, UI:R), the attack surface is the client-side parser rather than a network service, and the resulting primitive is a crash plus a bounded out-of-bounds read that may disclose small amounts of adjacent heap memory (C:L) but does not by itself provide a write primitive or control-flow hijack. The CPE entries cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader use unversioned wildcards, indicating the advisory covers the product lines generally rather than a single fixed build, so version-specific exposure must be confirmed against Foxit's published security bulletins.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Local file-parse bug requiring the victim to open a malicious PDF (AV:L, UI:R); OOB read yields a crash (A:H) and minor memory leak (C:L), with no integrity impact.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.
Zero Day Initiative Advisories
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB