ZDI discloses two Foxit PDF Reader directory traversal RCE flaws: ZDI-26-733 (CVE-2026-91797) and ZDI-26-734 (CVE-2026-91801)

The Zero Day Initiative published two Foxit PDF Reader directory traversal vulnerabilities on 2026-09-23 — one in Portfolio handling, one in RichMedia annotations — each rated CVSS 7.8 and capable of remote code execution after user interaction; neither is…

On 2026-09-23, the Zero Day Initiative published two advisories for directory traversal vulnerabilities in Foxit PDF Reader, both permitting remote code execution. ZDI-26-733 (CVE-2026-91797) affects the application's Portfolio handling, while ZDI-26-734 (CVE-2026-91801) affects RichMedia annotation handling. In each case, ZDI assigned a CVSS score of 7.8 and states that a remote attacker can execute arbitrary code on affected installations, but only after user interaction — specifically, the target must open a malicious file or visit a malicious page. Neither advisory reports exploitation in the wild. The advisories do not specify affected version numbers or patch availability.

• ZDI published advisories ZDI-26-733 and ZDI-26-734 on 2026-09-23 (timestamp 2026-09-23T05:00:00Z), both concerning Foxit PDF Reader.
• ZDI-26-733 is a directory traversal flaw in Foxit PDF Reader Portfolio handling, tracked as CVE-2026-91797.
• ZDI-26-734 is a directory traversal flaw in Foxit PDF Reader RichMedia annotation handling, tracked as CVE-2026-91801.
• Both vulnerabilities are rated CVSS 7.8 by ZDI.
• Both flaws allow a remote attacker to execute arbitrary code, but require user interaction: the target must open a malicious file or visit a malicious page.
• Neither advisory reports active or in-the-wild exploitation.
• The reports do not state affected Foxit PDF Reader versions or patch status.
• The two source reports are consistent; no factual disagreements were found.