CVE-2026-91788

Analyzed Analyzed - Analysis Complete

Information Disclosure in Foxit PDF Editor/Reader

Publication date: 2026-09-23

Last updated on: 2026-10-29

Assigner: Foxit

Description

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-29

Generated

2026-11-08

AI Q&A

2026-09-23

EPSS Evaluated

2026-11-07

NVD

CVE-2026-91788

EUVD

EUVD-2026-85133

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)
foxit	pdf_editor	to 13.2.6.24111 (inc)
foxit	pdf_editor	From 2023.1.0.55583 (inc) to 2023.3.0.63083 (inc)
foxit	pdf_editor	From 2024.1.0.63682 (inc) to 2024.4.1.66479 (inc)
foxit	pdf_editor	From 2025.1.0.66692 (inc) to 2025.3.0.69570 (inc)
foxit	pdf_editor	From 14.0.0.68868 (inc) to 14.0.7.69441 (inc)
foxit	pdf_editor	From 2026.1.0.70169 (inc) to 2026.2.0.72029 (inc)
foxit	pdf_editor	to 13.2.6.63484 (inc)
foxit	pdf_reader	to 2026.2.0.72029 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Foxit PDF Editor/Reader's JavaScript interface. When handling PDFs, the software fails to perform required attribute authorization checks as specified. This allows a trusted but malicious PDF to access sensitive data from other documents running in the same process and potentially send that data outside the system.

Detection Guidance

This vulnerability involves insufficient attribute authorization checks in Foxit PDF Editor/Reader's JavaScript interface. Detection requires inspecting PDF files for malicious JavaScript execution or unauthorized document access attempts. Check Foxit application logs for suspicious PDF processing events or external data transmission. Use process monitoring tools like Process Explorer or Wireshark to observe Foxit Reader/Editor behavior when opening untrusted PDFs.

Impact Analysis

If you use Foxit PDF Editor or Reader, a malicious PDF could steal sensitive information from other open documents on your system. This could include confidential files, personal data, or credentials. The attacker would need to trick you into opening the malicious PDF while other sensitive documents are open.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using Foxit software may face compliance violations if sensitive data is leaked due to this flaw.

Mitigation Strategies

Update Foxit PDF Editor or Reader to the latest version to ensure the vulnerability is patched. Avoid opening untrusted PDF files until the update is applied. Monitor network traffic for unusual data exfiltration attempts from PDF processes.

Hi! I’m here to help you understand CVE-2026-91788. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...