EUVD-2026-85163
GHSA-7v6h-45pg-ghrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malicious PRC 3D mesh
-
DeliveryDeliver file to victim via email/web
-
ExploitVictim opens file in Foxit
-
ExecutionOut-of-bounds write during vertex-index parsing
-
PersistHeap memory corruption
-
ImpactCrash or arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted PDF that embeds a PRC 3D model containing a triangular fan texture mesh with malformed/out-of-range vertex indices, using Foxit PDF Editor or Foxit PDF Reader. Limiting factors: mandatory user interaction (UI:R - the file must be opened), local attack vector (AV:L - no remote/network-triggered path), and the fact that the flaw is confined to the PRC/3D-content parsing path, so only PDFs exercising that feature trigger it. No authentication is required (PR:N), but no privilege is gained beyond the application context. |
| Impact | This is a client-side, file-parsing memory-corruption flaw in Foxit's PRC (Product Representation Compact / 3D) parser. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) is internally consistent for a document-borne vulnerability: AV:L because the malicious PRC-embedded PDF must be opened on the local machine, and UI:R because a user must open the crafted file. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - only the vendor's own security bulletin - so exploitation status is 'no public exploit identified at time of analysis'. A notable tension exists between the impact metrics and the description: the CVSS claims full C:H/I:H/A:H (implying arbitrary code execution), yet the description only states 'memory corruption and an application crash', which reads as denial-of-service. Heap-based out-of-bounds writes (CWE-787) frequently ARE escalatable to code execution, so the vendor's C:H/I:H rating is plausible but not demonstrated by the description - verify the true exploitability with Foxit before treating this as confirmed RCE. Overall this is a real but not urgent priority: no evidence of active exploitation, and exploitation depends on social-engineering a user into opening a crafted 3D-PDF. |
| Exploit ScenarioDerived | An attacker crafts a PDF containing a malicious PRC 3D model with a triangular fan texture mesh whose vertex indices are out of range, and delivers it via email or a download link. When the victim opens the file in Foxit PDF Editor or Reader, the PRC parser writes past a heap buffer, corrupting memory and crashing the application - and potentially executing attacker-controlled code. No public proof-of-concept is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.
RemediationAI
The input data does not include an exact fixed version, so patch status is not independently confirmed here; the authoritative source is Foxit's security bulletin page (https://www.foxit.com/support/security-bulletins.html), which lists the corrected build for this PRC parser issue, and installing the newest Foxit PDF Editor/Reader release for your platform is the only complete fix because the flaw lives in the product's own rendering engine. Until that build is deployed, apply compensating controls that specifically break the exploitation path: disable or restrict rendering of embedded 3D/PRC content in Foxit's preferences (Preferences > Multimedia/3D, and enable Safe Reading Mode/Protected View so untrusted PDFs cannot load rich content) - the trade-off is that legitimate engineering PDFs with interactive 3D models will no longer render; strip or block PRC-containing PDFs at email and web gateways using content inspection or attachment policies, accepting that this may block valid technical documentation; and require users to open untrusted PDFs only in a sandboxed or low-privilege viewer session, which reduces the value of the memory-corruption primitive but does not eliminate the crash. Because exploitation requires a user to open a malicious file (UI:R), reinforce user awareness of unexpected PDF attachments alongside these controls, and monitor endpoints with EDR for Foxit process crashes or anomalous child-process spawns as a detection signal for attempted exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic out-of-bounds write (CWE-787) inside Foxit's parser for PRC (Product Representation Compact), the ISO 14739-1 binary 3D format commonly embedded in PDF/E and technical-drawing PDFs. When rendering a triangular fan texture mesh, the parser uses attacker-supplied vertex indices to address texture-coordinate or vertex buffers without adequately validating them against the mesh's declared array bounds, so an index that points past the end of the heap allocation causes a write beyond the buffer. Because the corrupted object is heap-allocated memory owned by the PDF/3D rendering pipeline, exploitation degrades into memory corruption rather than a clean parse abort, which is why the assessed impact covers high confidentiality, integrity, and availability loss. Reachable through the PRC/3D parsing path only, the bug is not triggered by ordinary 2D PDF content, and the CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms a client-side, file-open-driven condition with mandatory user interaction and no privilege elevation beyond the Foxit application context. CPE data (cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*) maps the affected code to Foxit PDF Editor and Foxit PDF Reader rather than to a third-party PRC SDK, confirming the vulnerable parsing code ships within Foxit's own product line.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file must be opened by the user (AV:L/UI:R), no auth needed (PR:N); heap OOB write plausibly yields code execution so C/I/A:H, matching the vendor despite the description emphasizing crash.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.
Zero Day Initiative Advisories
Executive ViewAI
Foxit PDF Editor and Foxit PDF Reader contain a high-severity heap memory corruption flaw in the PRC 3D-content parser that can crash the application or potentially allow code execution when a user opens a crafted PDF. This affects staff who handle PDFs, especially engineering and 3D-CAD workflows, and creates operational risk through email, web-download, or file-share delivery. No public exploit identified at time of analysis, but leadership should treat this as a high-priority unpatched application risk requiring interim controls and heightened user awareness until a vendor fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or restricting 3D/PRC content rendering in Foxit where supported, enabling Safe Reading/Protected View or equivalent hardened modes, blocking untrusted PDF attachments, isolating high-risk PDF opening in sandboxed viewers or VMs, enforcing least privilege, and monitoring for Foxit crashes or suspicious child processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB