ZDI-26-737: Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

CVE-2026-91808 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor Reader's handling of PDF image objects whose compression metadata is inconsistent, related to JPEG file parsing per ZDI advisory ZDI-26-737. When a crafted PDF is opened, insufficient validation during image decoding can allocate an undersized buffer, and reading beyond it during rendering crashes the application. An attacker gains a denial-of-service condition and potentially limited information disclosure (memory contents) via the out-of-bounds read. Exploitation requires convincing a user to open a malicious PDF, since the attack vector is local with user interaction required and no privileges needed. The flaw is not in the CISA KEV catalog and no public proof-of-concept is known, so there is no evidence of active exploitation.