Out-of-Bounds Read Vulnerability in Foxit PDF Editor and Reader
CVE-2026-91807

6.1MEDIUM

Key Information:

Vendor

Foxit Inc.

Status
Foxit PDF Editor
Foxit
Vendor
CVE Published:
23 September 2026

What is CVE-2026-91807?

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor and Reader's processing of malformed image soft-mask data. This flaw arises from inadequate validation of the soft-mask data attribute during image parsing. An attacker can exploit this vulnerability to trigger an arithmetic underflow, which may lead to an out-of-bounds read. Consequently, this could cause the application to crash, compromising the stability and reliability of the PDF handling functionality.

Affected Version(s)

Foxit PDF Editor MacOS Versions 2026.2 and earlier

Foxit PDF Editor MacOS Versions 14.0.7 and earlier

Foxit PDF Editor MacOS Versions 13.2.6 and earlier

References

https://www.foxit.com/support/security-bulletins.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with TrendAI Zero Day Initiative
.