CVE-2026-91788

Foxit PDF Editor and Foxit PDF Reader fail to enforce the attribute-level authorization checks required by the PDF JavaScript specification, in the area of the activeDocs interface. When a victim opens a malicious PDF that is treated as trusted, its embedded JavaScript can read sensitive content from other documents open in the same process and transmit that data to an external party. The impact is confidentiality-only (high confidentiality impact, no integrity or availability impact), and exploitation requires user interaction with high attack complexity, limiting its practical severity to medium (CVSS 4.7). Anyone running an unpatched Foxit PDF Editor or Reader on Windows or other supported desktop platforms is affected. There is no known public proof of concept, and the flaw is not on the CISA Known Exploited Vulnerabilities list.

What to do: Upgrade Foxit PDF Editor and Reader to the latest release that remediates ZDI-26-720 (confirm the exact fixed build in Foxit's security advisory, since affected ranges were not listed here). As a defense-in-depth measure, disable or restrict JavaScript execution in Foxit's preferences so untrusted documents cannot script the activeDocs interface, and remind users to open PDFs only from known sources. Watch for unusual outbound network traffic from the PDF application, which could indicate attempted exfiltration.