CVE-2026-91810

Analyzed Analyzed - Analysis Complete

Heap Out-of-Bounds Read in Foxit PDF Editor

Publication date: 2026-09-23

Last updated on: 2026-10-08

Assigner: Foxit

Description

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-08

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-91810

EUVD

EUVD-2026-85164

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	to 13.2.5.63482 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a heap-based out-of-bounds read vulnerability in Foxit PDF Editor/Reader. It occurs when the software processes malformed PDF image masks with inconsistent metadata. During rendering, incorrect alpha-channel handling leads to reading memory outside allocated bounds, causing the application to crash.

Detection Guidance

This vulnerability involves a heap-based out-of-bounds read in Foxit PDF Editor/Reader when processing malformed PDF image masks. Detection requires inspecting PDF files for inconsistent image metadata or alpha-channel issues. No direct commands are provided in the context, but monitoring for application crashes during PDF rendering may indicate exploitation.

Impact Analysis

An attacker could exploit this to crash the application, potentially leading to denial-of-service. If exploited, it might allow limited information disclosure or further system compromise depending on the environment.

Compliance Impact

This vulnerability may lead to application crashes but does not directly indicate data exposure or unauthorized access. Compliance impact depends on whether the crash disrupts data processing or storage workflows. No evidence suggests direct violations of GDPR or HIPAA based on the provided details.

Mitigation Strategies

Update Foxit PDF Editor or Reader to the latest version to patch the vulnerability. Avoid opening untrusted PDF files, especially those with malformed image masks. Monitor application crashes during PDF rendering as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-91810. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70