AI analysis
CVE-2026-91807 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor and Foxit PDF Reader caused by insufficient validation of an image's soft-mask data attribute during PDF parsing, which can trigger an arithmetic underflow when computing read bounds. An attacker triggers the flaw by convincing a user to open a specially crafted PDF, since the vector is local with user interaction required and no privileges needed. Successful exploitation crashes the application (high availability impact) and may disclose a limited amount of process heap memory, consistent with the ZDI-26-736 characterization as an information disclosure vulnerability. Anyone opening untrusted PDFs with an affected Foxit PDF Editor or Reader build is exposed, though the advisory data does not enumerate specific version ranges. There is no known public proof of concept and no evidence of in-the-wild exploitation; the flaw is not on the CISA KEV list.
What to do: Update Foxit PDF Editor and PDF Reader to the latest release as soon as Foxit ships the fix, and verify the exact patched versions against Foxit's security advisories and the ZDI-26-736 bulletin since this record does not enumerate them. In the interim, avoid opening PDFs from untrusted or unexpected sources, and use perimeter email/web filtering or sandboxed viewing for inbound documents. Watch for application crashes on PDF open as a potential indicator of crafted files probing this flaw.
Affected
| Foxit Software Foxit PDF Reader | — |
| Foxit Software Foxit PDF Editor | — |
Estimated exposure
mass≈100M+ desktop installations (order of magnitude) — Foxit PDF Reader is a free, globally distributed desktop application whose vendor-marketed install base runs to hundreds of millions of users, so a parsing flaw in current-generation builds plausibly reaches tens to hundreds of millions of…
Description
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.