RCE in Foxit PDF Editor/Reader Texture Decoding Path (CVE-2026-91789)
Foxit PDF Editor/Reader contains a vulnerability in its U3D/GIF texture decoding path that lacks sufficient validation of image dimensions and size information. This flaw can cause incorrect memory allocation and a subsequent out-of-bounds write during pixel processing, potentially leading to remote code execution. An attacker could potentially exploit this to gain remote access or execute arbitrary code. The affected product is Foxit PDF Editor/Reader, and the current exploitation status is none known.
What to do: Upgrade to patched versions of Foxit PDF Editor/Reader. Implement strict image dimension and size validation, disable U3D/GIF texture decoding paths, and enforce strict memory bounds to prevent out-of-bounds writes. Regularly audit deployed plugins and verify exposure of sensitive processing paths.
| Foxit PDF Editor/Reader | Patched versions |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this could lead to an incorrectly sized memory allocation and a subsequent out-of-bounds write during pixel processing, potentially resulting in remote code execution.
ZDI disclosed a Foxit PDF Reader U3D integer overflow that can enable remote code execution.
ZDI-26-721 covers an integer overflow in Foxit PDF Reader while parsing U3D content, which can allow remote code execution. A user must open a malicious file or visit a malicious page. ZDI assigned CVSS 7.8 and CVE-2026-91789. The advisory does not say the flaw is being exploited.