ZDI discloses two Foxit PDF Reader out-of-bounds read information disclosure vulnerabilities (CVE-2026-91807, CVE-2026-91808)

ZDI published two Foxit PDF Reader advisories for out-of-bounds read flaws in PDF and JPEG file parsing that can disclose sensitive information to a remote attacker; both are rated CVSS 3.3 and require user interaction.

On 2026-09-23, ZDI published two advisories covering out-of-bounds read vulnerabilities in Foxit PDF Reader. ZDI-26-736 (CVE-2026-91807) is an out-of-bounds read during PDF file parsing, and ZDI-26-737 (CVE-2026-91808) is an out-of-bounds read during JPEG file parsing. Both flaws can disclose sensitive information to a remote attacker, but only if a user opens a malicious file or visits a malicious page. ZDI assigned a CVSS score of 3.3 to each vulnerability, and neither advisory mentions exploitation in the wild.

• Two ZDI advisories published 2026-09-23: ZDI-26-736 and ZDI-26-737.
• ZDI-26-736 (CVE-2026-91807) is an out-of-bounds read in Foxit PDF Reader PDF file parsing.
• ZDI-26-737 (CVE-2026-91808) is an out-of-bounds read in Foxit PDF Reader JPEG file parsing.
• Both vulnerabilities can disclose sensitive information to a remote attacker.
• Both require user interaction: the user must visit a malicious page or open a malicious file.
• ZDI assigned CVSS 3.3 to both vulnerabilities.
• No exploitation in the wild is mentioned in either advisory.