CVE-2026-91793
HIGH 7.8When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.
Severe if exploited (CVSS 7.8), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 6th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Foxit Software Inc. Foxit Microsoft
Products Foxit Pdf Editor Foxit Pdf Reader Pdf Editor Pdf Reader Windows
Weakness (CWE)
- CWE-416: Use after free
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References and research data (JSON)
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Foxit | Pdf Editor | ≤ 13.2.5.63482 |
| Foxit | Pdf Editor | ≥ 14.0.0.33046 and ≤ 14.0.7.33751 |
| Foxit | Pdf Editor | ≥ 2023.1.0.15510 and ≤ 2023.3.0.23028 |
| Foxit | Pdf Editor | ≥ 2024.1.0.23997 and ≤ 2024.4.1.27687 |
| Foxit | Pdf Editor | ≥ 2025.1.0.27937 and ≤ 2025.3.0.35737 |
| Foxit | Pdf Editor | ≥ 2026.1.0.36452 and ≤ 2026.2.0.39747 |
| Foxit | Pdf Reader | ≤ 2026.2.0.39747 |
All CVSS metrics
- HIGH 7.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Advisories
- https://www.foxit.com/support/security-bulletins.html CVE record · Foxit · Updated 2026-09-23T07:51:16.346Z
NVD · CVE-2026-91793 · Updated 2026-10-08T13:47:43.337 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85129 EUVD · EUVD-2026-85129