CVE-2026-91810

A heap-based out-of-bounds read (CWE-125) exists in how Foxit PDF Editor and Foxit PDF Reader process image masks in PDF files: inconsistent image metadata causes incorrect alpha-channel processing during rendering, so the application reads past the end of an allocated heap buffer. The flaw is triggered when a user opens a specially crafted PDF, meaning an attacker must first deliver the malicious file and induce the victim to open it (attack vector is local with user interaction required). Successful exploitation crashes the application (high availability impact) and, consistent with the related ZDI-26-739 bulletin on out-of-bounds reads in Foxit PDF Reader, can leak a small amount of adjacent memory as information disclosure. Any unpatched desktop running Foxit PDF Editor or Foxit PDF Reader is affected, with enterprise and government estates — where Foxit is a widely deployed Adobe alternative — the most exposed. There is no known public proof-of-concept, no evidence of exploitation in the wild, and the flaw is not on CISA's Known Exploited Vulnerabilities list.

What to do: Update Foxit PDF Editor and Foxit PDF Reader to the fixed release named in Foxit's security advisory or ZDI bulletin ZDI-26-739 — the provided data does not state a specific patched version, so pull the exact build number from the vendor bulletin. Because exploitation requires the user to open a crafted PDF, warn users against opening unsolicited or untrusted documents and consider isolating PDF rendering from high-value sessions. As a detection signal, look for Foxit crash dumps and application stability events (hangs/crashes on PDF open) that correlate with inbound document deliveries.