CVE-2026-91807

CVE-2026-91807 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor and Foxit PDF Reader caused by insufficient validation of an image's soft-mask data attribute during PDF parsing, which can trigger an arithmetic underflow when computing read bounds. An attacker triggers the flaw by convincing a user to open a specially crafted PDF, since the vector is local with user interaction required and no privileges needed. Successful exploitation crashes the application (high availability impact) and may disclose a limited amount of process heap memory, consistent with the ZDI-26-736 characterization as an information disclosure vulnerability. Anyone opening untrusted PDFs with an affected Foxit PDF Editor or Reader build is exposed, though the advisory data does not enumerate specific version ranges. There is no known public proof of concept and no evidence of in-the-wild exploitation; the flaw is not on the CISA KEV list.

What to do: Update Foxit PDF Editor and PDF Reader to the latest release as soon as Foxit ships the fix, and verify the exact patched versions against Foxit's security advisories and the ZDI-26-736 bulletin since this record does not enumerate them. In the interim, avoid opening PDFs from untrusted or unexpected sources, and use perimeter email/web filtering or sandboxed viewing for inbound documents. Watch for application crashes on PDF open as a potential indicator of crafted files probing this flaw.