CVE-2026-91811

CVE-2026-91811 is a heap-based out-of-bounds write (CWE-787) in the PRC parser of Foxit PDF Editor and Reader, caused by insufficient validation of vertex indices when parsing triangular fan texture meshes in PRC 3D content embedded in PDF files. An attacker triggers the flaw by convincing a user to open a specially crafted PDF containing malformed PRC 3D data; the CVSS 3.1 vector (7.8, AV:L/PR:N/UI:R) confirms user interaction is required and no privileges are needed. Successful exploitation corrupts heap memory, causing an application crash, and the High confidentiality/integrity/availability impact ratings indicate potential code execution in the context of the user running the application. Anyone using affected builds of Foxit PDF Editor or Foxit PDF Reader is exposed, with the risk concentrated in environments that routinely open PDFs from external senders. There is no known public proof-of-concept, the flaw is not in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade Foxit PDF Editor/Reader to the latest patched release as soon as Foxit publishes the fix, and verify the affected version list in the vendor's security advisory since no fixed version numbers were provided here. Until patched, avoid opening PDFs from untrusted or unexpected sources, scan inbound PDFs at the mail gateway, and consider disabling 3D/PRC content rendering where workflows permit. Vendors should also watch for follow-on PoCs, since a reliable heap write primitive in a default document parser is an attractive target.