CVE-2026-91807
Received Received - Intake

Heap Out-of-Bounds Read in Foxit PDF Editor

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Foxit

Description
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-91807
EUVD
EUVD-2026-85117

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
foxit pdf_editor *
foxit pdf_reader *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based out-of-bounds read vulnerability in Foxit PDF Editor/Reader. It occurs when the software processes malformed image soft-mask data without proper validation. This can lead to an arithmetic underflow, causing the software to read memory outside its allocated bounds and potentially crash.

Detection Guidance

This vulnerability involves a heap-based out-of-bounds read in Foxit PDF Editor/Reader due to improper handling of malformed image soft-mask data. Detection typically requires analyzing PDF files for malformed soft-mask attributes or monitoring application crashes during image parsing. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker could exploit this vulnerability by tricking you into opening a specially crafted PDF file. This might cause the application to crash or allow the attacker to access sensitive information from memory. It requires user interaction but does not need elevated privileges.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive data through out-of-bounds reads. If exploited, it could lead to unauthorized access to memory contents, risking data breaches that violate confidentiality requirements under these regulations.

Mitigation Strategies

Update Foxit PDF Editor or Reader to the latest version to patch the vulnerability. Avoid opening untrusted PDF files, especially those containing malformed image soft-mask data. Disable automatic PDF opening in web browsers if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart