Heap Out-of-Bounds Read in Foxit PDF Editor/Reader via Embedded PDF JavaScript
A heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor and Foxit PDF Reader arises from insufficient validation of string-deletion ranges when processing wide strings in JavaScript embedded inside a PDF. The flaw is triggered when a victim opens a maliciously crafted PDF: the unvalidated range causes an integer underflow, which drives an out-of-bounds heap read and crashes the application. The CVSS vector indicates the primary impact is availability (denial of service), with a smaller possibility of limited disclosure of heap memory contents; exploitation requires user interaction but no privileges. A related ZDI advisory (ZDI-26-745) describes an AcroForm out-of-bounds read in Foxit PDF Reader rated for remote code execution, suggesting this parser area can host more severe bugs than the crash described here. The issue is not in CISA's KEV catalog, no public proof of concept exists, and no exploitation in the wild is known.
What to do: Update Foxit PDF Editor and Reader to the latest release and confirm the fixed version in the vendor's security advisory, since the exact patched builds are not stated in this data. As an interim mitigation, disable JavaScript execution for PDFs in Foxit's preferences and treat PDFs from untrusted sources (email attachments, downloads) with suspicion, since the flaw requires a user to open a crafted document. Administrators should also watch the related ZDI-26-745 advisory, as the same code area carries a higher-severity AcroForm out-of-bounds read.
| Foxit Software Foxit PDF Editor | — |
| Foxit Software Foxit PDF Reader | — |
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Foxit PDF Reader AcroForm out-of-bounds read may allow remote code execution with user interaction.
ZDI advisory ZDI-26-745 discloses an out-of-bounds read in Foxit PDF Reader AcroForm handling that can lead to remote code execution. The victim must open a malicious file or visit a malicious page. ZDI assigned CVSS 7.8 and CVE-2026-91817. The notice does not state that the flaw is being exploited.