EUVD-2026-85160
GHSA-37h4-4ww6-hgx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malformed JPEG2000 metadata
-
DeliveryDeliver document to victim (email/web)
-
ExploitVictim opens file in Foxit
-
ExecutionDecoder triggers heap out-of-bounds write
-
PersistCorrupt heap for control-flow hijack
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or render a specially crafted PDF containing a malformed JPEG2000 image whose metadata is not sufficiently validated by Foxit PDF Editor/Reader; the malicious image data itself is the trigger. Limiting factors: the CVSS vector is AV:L with UI:R, so the attacker cannot trigger this remotely without user interaction - a user must actively open the attacker's file in an affected Foxit product, and no authentication is involved (PR:N) but exploitation runs only in the opening user's context. Affected versions and the fixed build are not enumerated in the provided data. |
| Impact | This is a client-side, file-parsing memory-corruption bug (CWE-787 heap out-of-bounds write) in Foxit PDF Editor/Reader's JPEG2000 image-metadata decoding. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) is internally consistent with a malicious-document attack: AV:L plus UI:R means the victim must open or process an attacker-supplied PDF locally, so this is not a remotely-triggerable server flaw despite the network-facing implication of PDF delivery. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The 7.8 rating reflects worst-case arbitrary code execution, but the description hedges ('potentially causing the program to crash and introducing the risk of arbitrary code execution'), meaning a reliable RCE primitive is not confirmed - crash/DoS is the assured outcome and code execution is aspirational without a working exploit and heap-grooming. Net: real but not urgent - a credible client-side RCE candidate in a very widely deployed reader, warranting prompt patching, but with no evidence of active or imminent exploitation. Key missing signals: EPSS probability, precise fixed version, and exploit maturity all absent from the single vendor-bulletin reference. |
| Exploit ScenarioDerived | An attacker crafts a PDF containing a malformed JPEG2000 image with manipulated metadata and delivers it via email, web download, or a shared drive. When the victim opens the file in Foxit PDF Editor/Reader, the decoder writes out of bounds on the heap, crashing the application and potentially allowing attacker-controlled code execution in the user's context. No public exploit code is identified at this time, and successful code execution (versus a mere crash) would require additional heap-grooming reliability work. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.
RemediationAI
Patch status per available data: No vendor-released patch identified at time of analysis - the only supplied reference is Foxit's security bulletin index (https://www.foxit.com/support/security-bulletins.html), which should be consulted directly to obtain the exact fixed build numbers for Foxit PDF Editor and Foxit PDF Reader and to confirm which release lines are covered; do not assume a version number that is not published there. Until the fixed build is confirmed and deployed, apply specific compensating controls with their trade-offs: enable Protected View / Safe Reading Mode / the read-only sandboxed rendering mode in Foxit so an opened document is rendered without full process privileges (side effect: some interactive PDF features and form workflows are disabled or require explicit user approval); enforce application-level sandboxing on the reader via the operating system (Windows Defender Application Guard / AppContainer, macOS App Sandbox or a third-party sandbox such as the browser-based viewer) to contain a successful heap write, at the cost of reduced functionality and possible rendering differences; block or strip JPEG2000/JPXDecode image streams from untrusted PDFs at the email or web gateway with a PDF sanitizer that re-encodes or removes JPX images (trade-off: documents relying on JPEG2000 images will render without those images or must be flattened to raster before delivery); and disallow direct user opening of PDFs from email attachments and downloads, preferring a hardened, sandboxed, or virtualized viewer. Because the CVSS vector is AV:L/UI:R, reducing the volume of untrusted PDFs that reach user desktops - rather than network filtering of an exploitable service - is the highest-value short-term mitigation. EDR/AV teams should watch for Foxit process crashes accompanied by heap-corruption signatures following PDF opens as a detection signal, since a crash is the most observable precursor to a successful exploit. No public exploit code was identified at time of analysis, so the urgency is driven by the severity of the memory-corruption class rather than by observed exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write) in the JPEG2000 (JP2/J2K, typically the JPXDecode filter path) image-decoding logic used by Foxit PDF Editor and Foxit PDF Reader. PDF supports JPEG2000-compressed image streams, and the decoder must parse image headers and metadata structures such as the image header box, colour specification box and codestream marker segments before allocating and filling heap buffers. When lengths, dimensions, component counts or component-to-buffer mappings from that metadata are not cross-validated against the actual decoded codestream, an attacker can declare values that make the decoder compute a smaller allocation than the amount of data it subsequently writes - producing a heap buffer overflow during decoding. CWE-787 is a memory-corruption class that classically yields attacker-influenced heap layout, and with the high C/I/A ratings in the assessed vector it can progress from denial of service (crash) to arbitrary code execution in the context of the Foxit process. The CPE data (cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*) indicates both the Editor and Reader product lines are affected and that specific vulnerable version ranges were not enumerated in the supplied data. This is a decoder-side parsing weakness in the image library path, not a JavaScript/action or PDF-sandbox escape issue, so mitigations that disable scripting alone will not close it.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file vector (AV:L) needing the victim to open the PDF (UI:R), no privileges (PR:N); heap OOB write enabling potential arbitrary code execution yields C/I/A:H.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and Foxit PDF Reader are affected by a high-severity memory-safety flaw that can be triggered when a user opens a specially crafted PDF, potentially compromising confidentiality, integrity, and availability in that user's context. The primary business risk is targeted document-based phishing against staff who handle external PDFs, but exploitation requires user interaction and no public exploit identified at time of analysis; leadership should prioritize inventory, user guidance, and vendor patch tracking.
No vendor-released patch identified at time of analysis. Interim mitigations include blocking or sandboxing untrusted PDFs, using an alternate PDF viewer for external documents where feasible, enforcing least privilege and application allowlisting, and monitoring for suspicious PDF activity; apply vendor patch once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading t
Exploit-DB