CVE-2026-91788
Received Received - Intake

Information Disclosure in Foxit PDF Editor/Reader

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Foxit

Description
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-91788
EUVD
EUVD-2026-85133

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
foxit pdf_editor_reader *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in Foxit PDF Editor/Reader's JavaScript interface. When handling PDFs, the software fails to perform required attribute authorization checks as specified. This allows a trusted but malicious PDF to access sensitive data from other documents running in the same process and potentially send that data outside the system.

Impact Analysis

If you use Foxit PDF Editor or Reader, a malicious PDF could steal sensitive information from other open documents on your system. This could include confidential files, personal data, or credentials. The attacker would need to trick you into opening the malicious PDF while other sensitive documents are open.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using Foxit software may face compliance violations if sensitive data is leaked due to this flaw.

Mitigation Strategies

Update Foxit PDF Editor or Reader to the latest version to ensure the vulnerability is patched. Avoid opening untrusted PDF files until the update is applied. Monitor network traffic for unusual data exfiltration attempts from PDF processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart