ZDI Publishes Ten Foxit PDF Reader CVSS 7.8 Bugs

On 2026-09-23 ZDI published 10 Foxit PDF Reader advisories, all CVSS 7.8 remote code execution bugs requiring user interaction, with no exploitation reported.

On 2026-09-23 Trend Micro's Zero Day Initiative published 10 Foxit PDF Reader advisories, each rated CVSS 7.8 and described as allowing remote code execution. The set covers three annotation use-after-frees (ZDI-26-722/CVE-2026-91791, ZDI-26-724/CVE-2026-91792, ZDI-26-746/CVE-2026-91818), an AcroForm use-after-free (ZDI-26-744/CVE-2026-91816), an AcroForm out-of-bounds read (ZDI-26-745/CVE-2026-91817), out-of-bounds writes in DeviceN colorspace handling (ZDI-26-730/CVE-2026-91794) and PRC stream parsing (ZDI-26-740/CVE-2026-91811), directory traversal in portfolio handling (ZDI-26-733/CVE-2026-91797) and RichMedia annotations (ZDI-26-734/CVE-2026-91801), and a U3D parsing integer overflow (ZDI-26-721/CVE-2026-91789). Every advisory says a remote attacker can execute arbitrary code only if a user opens a malicious file or visits a malicious page. None of the 10 notices reports exploitation in the wild, and none states affected versions or patch status. The reports are mutually consistent and do not disagree.