CVE-2026-91802

Analyzed Analyzed - Analysis Complete

Heap-based Out-of-Bounds Write in Foxit PDF Editor/Reader

Publication date: 2026-09-23

Last updated on: 2026-10-08

Assigner: Foxit

Description

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-08

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-91802

EUVD

EUVD-2026-85120

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	to 13.2.5.63482 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a heap-based out-of-bounds write vulnerability in Foxit PDF Editor/Reader caused by improper handling of bitmap stride and target buffer formats during WebP image decoding. It could lead to application crashes if exploited.

Detection Guidance

This vulnerability involves a heap-based out-of-bounds write in Foxit PDF Editor/Reader during WebP image decoding. Detection requires inspecting PDF files for malformed WebP images or monitoring application crashes during PDF processing. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

Exploitation could crash the application, potentially allowing attackers to execute arbitrary code or gain unauthorized access to sensitive data processed by the PDF software.

Compliance Impact

The vulnerability could lead to application crashes, potentially causing data corruption or loss. This may impact compliance with GDPR by risking unauthorized data access or processing disruptions, and with HIPAA by compromising the integrity of protected health information during processing.

Mitigation Strategies

Update Foxit PDF Editor or Reader to the latest version to patch the vulnerability. Disable WebP image decoding if not required or restrict processing of untrusted PDF files.

Hi! I’m here to help you understand CVE-2026-91802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70