CVE-2026-91808

CVE-2026-91808 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor Reader's handling of PDF image objects whose compression metadata is inconsistent, related to JPEG file parsing per ZDI advisory ZDI-26-737. When a crafted PDF is opened, insufficient validation during image decoding can allocate an undersized buffer, and reading beyond it during rendering crashes the application. An attacker gains a denial-of-service condition and potentially limited information disclosure (memory contents) via the out-of-bounds read. Exploitation requires convincing a user to open a malicious PDF, since the attack vector is local with user interaction required and no privileges needed. The flaw is not in the CISA KEV catalog and no public proof-of-concept is known, so there is no evidence of active exploitation.

What to do: Update Foxit PDF Editor/Reader to the most current release from Foxit's official download channel, since specific fixed versions were not stated in the advisory data. Treat unsolicited or untrusted PDFs (email attachments, web downloads) as malicious and open them only in a sandbox or Foxit's protected mode where available. Track ZDI-26-737 and Foxit security bulletins for patched version details and watch for any emergence of PoCs.