ZDI-26-731: Foxit PDF Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability
Foxit PDF Reader FileOpen flaw CVE-2026-91795 allows remote code execution if a user opens a malicious file.
42
Vulnerability3 · 2 reads
CVE-2026-91795
RCE via FileOpen Plugin in Foxit PDF Editor/Reader
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The CVE-2026-91795 flaw in Foxit PDF Editor/Reader's FileOpen plugin enables chained read and write access violations and potentially arbitrary code execution. It is triggered by specially crafted PDF files that contain improperly validated encryption metadata. An attacker can gain full system or application control. The affected scope includes all Foxit PDF Editor/Reader installations, though exact versions and counts are unknown.
What to do: Upgrade all affected Foxit PDF Editor/Reader installations to the latest patched versions. Implement robust plugin security checks and enforce strict file validation for encryption metadata. Monitor for chained access issues and conduct regular security assessments.
| Product | Affected |
|---|---|
| Foxit PDF Editor/Reader | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-822
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H