Foxit PDF Editor CVE-2026-91817

Exploitation requires the victim to open an attacker-crafted PDF containing embedded JavaScript in Foxit PDF Editor or Reader; the malicious JavaScript must perform a wide-string deletion with an out-of-range value that triggers the integer underflow. Limiting factors: the CVSS vector is local (AV:L) and requires user interaction (UI:R), so there is no remote or unauthenticated network exploitation - the attacker depends on social engineering to get the file opened, and JavaScript execution must be enabled in the reader. Impact is capped at limited memory disclosure and a crash (no code execution or integrity impact claimed).

This is a genuine but modest-severity issue. The CVSS 3.1 vector (6.1, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) describes a file-borne bug: the attacker cannot reach the victim over the network - the local attack vector plus UI:R means a user must open a malicious PDF. Impact is limited to a small confidentiality leak (C:L, from the out-of-bounds read) and application crash/denial of service (A:H); there is no integrity impact and no code execution claimed. CWE-125 (out-of-bounds read) is consistent with the description of an integer underflow in string-deletion range validation. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation. The signals are internally consistent: an OOB read that crashes the app but may disclose limited adjacent heap memory. This is a real defect worth patching, but not a high-priority emergency - real-world risk is bounded by the need for user interaction, the local vector, and the absence of RCE or exploitation evidence. Note: this was vendor-reported (Foxit) with only a generic security-bulletins reference, so exact affected/fixed versions are not confirmed from the provided data.

An attacker crafts a PDF containing embedded JavaScript that manipulates wide strings with a malformed deletion range, triggering an integer underflow. The attacker delivers the file via email or download and social-engineers the victim into opening it in Foxit PDF Editor/Reader, causing an out-of-bounds read that leaks limited heap memory and crashes the application. No public exploit was identified at time of analysis.