CVE-2026-91815

Analyzed Analyzed - Analysis Complete

Heap Out-of-Bounds Write in Foxit PDF Editor

Publication date: 2026-09-23

Last updated on: 2026-10-08

Assigner: Foxit

Description

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-08

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-91815

EUVD

EUVD-2026-85160

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	to 13.2.5.63482 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

Foxit PDF Editor/Reader has a flaw where it fails to properly check JPEG2000 image metadata in PDF files. This can lead to writing outside the intended memory area during image decoding, potentially crashing the program or allowing arbitrary code execution.

Detection Guidance

This vulnerability involves insufficient verification of JPEG2000 image metadata in PDF files, leading to potential heap buffer overflows. Detection primarily requires inspecting PDF files for malformed JPEG2000 streams. Use tools like pdfinfo, pdfimages, or custom scripts to parse PDFs and check for JPEG2000 metadata anomalies. No direct network detection commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious code on your system by tricking you into opening a specially crafted PDF file. This could lead to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could potentially lead to arbitrary code execution, which may result in unauthorized access to sensitive data. This could impact compliance with GDPR (data protection) and HIPAA (health information privacy) by exposing personal or health data.

Mitigation Strategies

Update Foxit PDF Editor/Reader to the latest version as soon as patches are available to address the JPEG2000 metadata verification issue.

Hi! I’m here to help you understand CVE-2026-91815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70