CVE-2026-91817

A heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor and Foxit PDF Reader arises from insufficient validation of string-deletion ranges when processing wide strings in JavaScript embedded inside a PDF. The flaw is triggered when a victim opens a maliciously crafted PDF: the unvalidated range causes an integer underflow, which drives an out-of-bounds heap read and crashes the application. The CVSS vector indicates the primary impact is availability (denial of service), with a smaller possibility of limited disclosure of heap memory contents; exploitation requires user interaction but no privileges. A related ZDI advisory (ZDI-26-745) describes an AcroForm out-of-bounds read in Foxit PDF Reader rated for remote code execution, suggesting this parser area can host more severe bugs than the crash described here. The issue is not in CISA's KEV catalog, no public proof of concept exists, and no exploitation in the wild is known.

What to do: Update Foxit PDF Editor and Reader to the latest release and confirm the fixed version in the vendor's security advisory, since the exact patched builds are not stated in this data. As an interim mitigation, disable JavaScript execution for PDFs in Foxit's preferences and treat PDFs from untrusted sources (email attachments, downloads) with suspicion, since the flaw requires a user to open a crafted document. Administrators should also watch the related ZDI-26-745 advisory, as the same code area carries a higher-severity AcroForm out-of-bounds read.