ZDI-26-737: Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI disclosed a Foxit PDF Reader JPEG parsing out-of-bounds read that can leak information (CVE-2026-91808).
ZDI-26-737 is an out-of-bounds read in Foxit PDF Reader's JPEG file parsing that can disclose sensitive information to a remote attacker. The user must visit a malicious page or open a malicious file. ZDI assigned CVSS 3.3 and CVE-2026-91808, with no statement of active exploitation.
- JPEG parsing out-of-bounds read can disclose information.
- User interaction via a malicious page or file is required.
- ZDI assigns CVSS 3.3 and CVE-2026-91808.
- No exploitation in the wild is mentioned.
- CVEs
- CVE-2026-91808
- Vendors
- Foxit
- Products
- Foxit PDF Reader
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91808 | Heap Out-of-Bounds Read in Foxit PDF Editor Reader Image Decoding | 6.1 | — |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.