CVE-2026-91796

Analyzed Analyzed - Analysis Complete

Foxit PDF Editor SMB Authentication Hash Leak via Malicious PDF

Publication date: 2026-09-23

Last updated on: 2026-10-08

Assigner: Foxit

Description

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-08

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-91796

EUVD

EUVD-2026-85126

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	to 13.2.5.63482 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability in Foxit PDF Editor/Reader allows specially crafted PDF files to bypass security prompts and trigger external SMB authentication. This can lead to the leakage of the user's credential hash without their knowledge.

Detection Guidance

This vulnerability involves Foxit PDF Editor/Reader leaking credential hashes via SMB authentication without prompts. To detect it, monitor network traffic for unexpected SMB authentication attempts originating from Foxit processes. Check for connections to unknown SMB servers or unusual PDF file interactions.

Impact Analysis

An attacker could exploit this to steal your hashed credentials, which might be cracked offline to gain access to your accounts. It could also allow unauthorized access to sensitive data if credentials are compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update Foxit PDF Editor/Reader to the latest patched version. Disable SMBv1 if enabled, as it is often exploited in such attacks. Restrict outbound SMB connections in firewall rules to prevent unauthorized credential hash leaks. Avoid opening PDFs from untrusted sources.

Hi! I’m here to help you understand CVE-2026-91796. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70