CVE-2026-91795

Published: Sep 23, 2026Modified: Oct 8, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 14984358-7092-470d-8f34-ade47a7658a2 (Secondary)

Description

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.

Affected (7)

Products: Foxit: Pdf Editor, Pdf Reader

Foxit

2 products

Pdf Editor

Pdf Reader

Configuration A

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Foxit Pdf Editor	version ≤ 13.2.5.63482
Foxit Pdf Editor	14.0.0.33046 ≤ version ≤ 14.0.7.33751
Foxit Pdf Editor	2023.1.0.15510 ≤ version ≤ 2023.3.0.23028
Foxit Pdf Editor	2024.1.0.23997 ≤ version ≤ 2024.4.1.27687
Foxit Pdf Editor	2025.1.0.27937 ≤ version ≤ 2025.3.0.35737
Foxit Pdf Editor	2026.1.0.36452 ≤ version ≤ 2026.2.0.39747
Foxit Pdf Reader	version ≤ 2026.2.0.39747

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-822

Untrusted Pointer Dereference

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

References (1)

https://www.foxit.com/support/security-bulletins.html

Source: 14984358-7092-470d-8f34-ade47a7658a2

Vendor Advisory

Timeline

No history available yet.