ZDI-26-743: Foxit PDF Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability
Foxit PDF Reader JPEG2000 parsing bug CVE-2026-91815 can yield remote code execution after user interaction.
ZDI-26-743 describes a JPEG2000 parsing memory-corruption vulnerability in Foxit PDF Reader that can lead to remote code execution. A user must open a malicious file or visit a malicious page. ZDI assigned CVSS 7.8 and CVE-2026-91815. Exploitation in the wild is not reported.
- Memory corruption occurs while parsing JPEG2000 content.
- Exploitation needs a user to open a malicious file or page.
- Tracked as CVE-2026-91815 with CVSS 7.8.
- No in-the-wild exploitation is stated.
- CVEs
- CVE-2026-91815
- Vendors
- Foxit
- Products
- Foxit PDF Reader
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91815 | JPEG2000 Metadata Verification Vulnerability in Foxit PDF Editor/Reader | 7.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.