Heap Out-of-Bounds Read in Foxit PDF Editor Reader Image Decoding
CVE-2026-91808 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor Reader's handling of PDF image objects whose compression metadata is inconsistent, related to JPEG file parsing per ZDI advisory ZDI-26-737. When a crafted PDF is opened, insufficient validation during image decoding can allocate an undersized buffer, and reading beyond it during rendering crashes the application. An attacker gains a denial-of-service condition and potentially limited information disclosure (memory contents) via the out-of-bounds read. Exploitation requires convincing a user to open a malicious PDF, since the attack vector is local with user interaction required and no privileges needed. The flaw is not in the CISA KEV catalog and no public proof-of-concept is known, so there is no evidence of active exploitation.
What to do: Update Foxit PDF Editor/Reader to the most current release from Foxit's official download channel, since specific fixed versions were not stated in the advisory data. Treat unsolicited or untrusted PDFs (email attachments, web downloads) as malicious and open them only in a sandbox or Foxit's protected mode where available. Track ZDI-26-737 and Foxit security bulletins for patched version details and watch for any emergence of PoCs.
| Foxit PDF Editor Reader (Foxit PDF Reader) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.
ZDI disclosed a Foxit PDF Reader JPEG parsing out-of-bounds read that can leak information (CVE-2026-91808).
ZDI-26-737 is an out-of-bounds read in Foxit PDF Reader's JPEG file parsing that can disclose sensitive information to a remote attacker. The user must visit a malicious page or open a malicious file. ZDI assigned CVSS 3.3 and CVE-2026-91808, with no statement of active exploitation.