Foxit PDF Editor CVE-2026-91814

Exploitation requires the attacker to obtain a genuinely signed PDF and craft an incremental update (PDF append/revision) that modifies visible document content without invalidating the existing digital signature, then deliver it to a victim who opens it in Foxit PDF Editor or Reader and relies on the signature-validity indicator. Limiting factors: the CVSS vector is PR:N (no authentication needed) but AC:H (crafting a non-invalidating incremental update is technically non-trivial) and UI:R (a victim must open the document and trust the signature UI); impact is confined to integrity/content-spoofing (I:H, C:N/A:N), so no data theft or crash results. Realistic risk is highest in signature-trust-dependent workflows (legal, financial, approval chains).

Signals are internally consistent and point to a genuine but moderate-severity integrity issue rather than a critical priority. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N = 5.3) is well-formed for a signature-validation bypass: no authentication (PR:N) but high attack complexity (AC:H, reflecting the effort to craft an incremental update that visually alters content yet leaves the signature apparently valid) and required user interaction (UI:R - a victim must open and trust the document). Impact is integrity-only (I:H) - the flaw enables content spoofing on a signed document, with no confidentiality (C:N) or availability (A:N) impact, so the 'Information Disclosure' tag is misleading. A public POC exists (a GitHub gist tagged as exploit by cve-search), which raises practical concern, but POC availability is NOT active exploitation: there is no CISA KEV listing and no EPSS score provided. No SSVC decision data is supplied. Net: this is a real, credible integrity/trust-boundary weakness in a widely deployed reader, but the AC:H, UI:R, and integrity-only ceiling keep real-world risk moderate - prioritize patching in signature-trust-sensitive workflows (contracts, legal, financial approvals) over general fleets. Note: no affected version numbers or fixed build are provided in the input - the only reference is a generic Foxit security-bulletins landing page, so patch verification is not possible from this data.

An attacker takes a legitimately signed PDF (e.g., an approved contract or invoice), appends a malicious incremental update that changes visible content such as a payment amount or payee, and redistributes it. Because the modified visible content does not invalidate the pre-existing signature, Foxit continues to display the document as validly signed, and a victim who opens it and relies on the signature indicator trusts the forged content. A public proof-of-concept exists demonstrating the incremental-update signature bypass, though the high attack complexity and required victim interaction limit mass exploitation.