ZDI-26-745: Foxit PDF Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
Foxit PDF Reader AcroForm out-of-bounds read may allow remote code execution with user interaction.
ZDI advisory ZDI-26-745 discloses an out-of-bounds read in Foxit PDF Reader AcroForm handling that can lead to remote code execution. The victim must open a malicious file or visit a malicious page. ZDI assigned CVSS 7.8 and CVE-2026-91817. The notice does not state that the flaw is being exploited.
- ZDI-26-745 is an AcroForm out-of-bounds read in Foxit PDF Reader.
- ZDI classifies the impact as remote code execution.
- Exploitation requires opening a malicious file or visiting a malicious page.
- CVE-2026-91817 is rated CVSS 7.8 by ZDI.
- CVEs
- CVE-2026-91817
- Vendors
- Foxit
- Products
- Foxit PDF Reader
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91817 | Heap Out-of-Bounds Read in Foxit PDF Editor/Reader via Embedded PDF JavaScript | 6.1 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.