CVE-2026-91788

Executive Summary

CVE-2026-91788 is an attribute-authorization bypass in the JavaScript interface implementation of Foxit PDF Editor and Foxit Reader. The product failed to enforce the attribute access checks mandated by the JavaScript specification, allowing a trusted malicious PDF to read sensitive content from other documents loaded within the same process and exfiltrate it to an external destination. Exploitation requires a user to open a crafted PDF (UI:R) and is scored CVSS 3.1 base 4.7, reflecting high confidentiality impact offset by local attack vector, high complexity, and required user interaction. No public PoC, exploit code, or Nuclei template is currently available, and no patch has been observed from any tracked source.

Technical Analysis

The vulnerability class is CWE-668, Exposure of Resource to Wrong Sphere. The affected component is Foxit's implementation of the JavaScript interface exposed to PDF documents. The JavaScript object model specified for PDF (ECMAScript for PDF) defines access-control semantics that govern which document objects, attributes, and privileged properties a script may read or invoke. According to the NVD description, Foxit's implementation skipped the attribute authorization checks the specification requires. Because those checks are absent, a script embedded in a malicious PDF can reach attributes it should be denied under the specification.

The critical second element is the phrase "access sensitive content from other documents within the same process and transmit it externally." This means the trust boundary that failed is not confined to the single opened PDF: the Foxit process is assumed to load or have loaded multiple documents, and the missing attribute checks permit cross-document reads of in-memory content that should remain isolated to each document. Once read, the script can transmit the harvested content to an attacker-controlled external endpoint. The description does not specify the exact API names, attributes, document object properties, or transport mechanism involved, so those implementation details are not asserted here. What can be stated with confidence at the class level is:

• Attack surface: PDF-embedded JavaScript executed by Foxit's JavaScript engine after the user opens the file.
• Root cause: missing attribute authorization checks defined by the JavaScript interface specification — an access-control gap, not a memory-corruption defect.
• Isolation failure: cross-document attribute reads within the same process, i.e., a process-level rather than document-level privilege boundary.
• Exfiltration path: external transmission from the scripting context.

The CVSS subscores align with this reading: Confidentiality is rated High (C:H) because arbitrary cross-document content may be read; Integrity and Availability are None (I:N/A:N), consistent with a pure information-disclosure flaw; Attack Vector is Local (AV:L) because a document must be opened on the host; Attack Complexity is High (AC:H) because reliable exploitation depends on the process state — specifically the presence of other sensitive documents loaded in the same Foxit process — and on the specific trust attributes of the malicious file; Privileges Required is None (PR:N); User Interaction is Required (UI:R). The CISA KEV catalog does not list this CVE, and EPSS has not assigned a score.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the NVD description. It uses no invented function names, endpoints, or parameters.

1. Reconnaissance / target identification. The attacker identifies victims who use Foxit PDF Editor or Foxit Reader in workflows where multiple sensitive PDFs are opened in the same application session — for example, legal, financial, engineering, or government staff who keep several confidential documents open simultaneously. The distribution channel is the "trusted malicious PDF": a document crafted to appear legitimate and to satisfy whatever trust attributes Foxit uses to permit JavaScript execution more broadly.

2. Triggering the flaw class. The user opens the crafted PDF. Its embedded JavaScript executes. Because the implementation omits the attribute authorization checks the specification requires, the script is able to query and read attributes (content-bearing properties) belonging to other documents resident in the same Foxit process — content it should be denied under a compliant implementation.

3. Payload/execution at the vulnerability-class level. The script gathers the cross-document data it can reach and encodes it for transport. Transmission occurs from the scripting context to an external destination. The description confirms exfiltration ("transmit it externally") but does not specify the transport primitive, so no particular networking call, URI scheme, or API path is claimed here. At the class level, this is scripted data theft riding on a missing authorization check.

4. Post-exploitation impact. The attacker receives sensitive content from documents other than the one the victim intentionally opened. Because I:N and A:N, nothing is modified or destroyed, so the victim receives no immediate evidence of tampering; the theft is silent. Detection must therefore rest on file, process, and network telemetry rather than on integrity signals.

Dependencies and caveats: exploitation reliability depends on the specific "trust" attributes of the malicious document and on whether other sensitive documents are already loaded in the same process, which is consistent with AC:H. No exploit code, PoC repository, or in-the-wild campaign is known at the time of writing.

Impact Assessment

Business impact. Loss of confidentiality over documents the victim never chose to share. In environments where a single Foxit process routinely holds multiple regulated or privileged PDFs (case files, contracts, design documents, personal records), one opened malicious PDF can disclose content spanning all of them. This creates regulatory exposure (data-protection breach notification), loss of attorney-client or commercial confidentiality, and follow-on risk if the leaked documents enable further targeting or fraud.

Affected systems. Endpoints running Foxit PDF Editor or Foxit Reader with JavaScript execution enabled, on which users open untrusted PDFs and maintain multiple documents open per process. The supplied data does not enumerate affected version ranges, so no version boundary can be asserted; treat all unpatched deployments as potentially affected pending vendor guidance.

Blast radius. Bounded by process lifetime and document set: content in Foxit processes on the victim host. There is no evidence in the description of code execution, privilege escalation, lateral movement, or persistence; the impact is disclosure. CVSS subscores reflect this precisely — C:H, I:N, A:N, AV:L, AC:H, PR:N, UI:R, S:U, base 4.7 Medium.

Severity context. The numeric score is moderate because of the local vector and high complexity, but a Medium score understates the data-loss potential in document-heavy, high-value workflows. Prioritization should consider data sensitivity rather than the score alone.

Detection Guidance

Detection is difficult because the activity resembles legitimate PDF scripting. The rules below are heuristic, based on the vulnerability class; they target file-level indicators and process/network behavior rather than claimed malicious API names.

Sigma Rule

title: Suspicious PDF JavaScript Activity - Foxit Cross-Document Attribute Access (CVE-2026-91788)
id: 8f2c1e6a-3b7d-4c9a-9e21-7a5d0c4b1f88
status: experimental
description: Detects Foxit PDF Editor/Reader processes loading PDF files from untrusted locations or spawning network connections after document open, consistent with cross-document data theft via missing attribute authorization checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91788
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1204.002
  - attack.collection
  - cve.2026.91788
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
      - '\FoxitPDFReader.exe'
  selection_userdirs:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Temp\'
      - '\Public\'
  selection_unc:
    CommandLine|contains: '\\'
  condition: selection_img and (selection_userdirs or selection_unc)
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate enterprise document management opens PDFs from redirected temp/cache paths
level: medium

YARA Rule

rule CVE_2026_91788_Foxit_PDF_JS_CrossDoc
{
    meta:
        description = "Heuristic detection of PDFs with embedded JavaScript that may attempt cross-document attribute access in Foxit PDF Editor/Reader (CVE-2026-91788). Class-level indicators only; no PoC available."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91788"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pdf = { 25 50 44 46 2D }              // %PDF-
        $js1 = "/JavaScript" ascii nocase
        $js2 = "/JS" ascii
        $js3 = "app.alert" ascii
        $js4 = "this.getField" ascii
        $js5 = "getURL" ascii nocase
        $js6 = "submitForm" ascii nocase
        $js7 = "XMLHttpRequest" ascii
        $js8 = "exportDataObject" ascii nocase
        $obf1 = "unescape(" ascii
        $obf2 = "eval(" ascii
        $obf3 = "String.fromCharCode" ascii

    condition:
        $pdf at 0 and
        filesize < 5MB and
        (2 of ($js1, $js2, $js3, $js4)) and
        (any of ($js5, $js6, $js7, $js8)) and
        (1 of ($obf1, $obf2, $obf3))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91788 Possible Foxit PDF JavaScript Data Exfiltration"; flow:established,to_server; content:"POST"; http_method; content:"Content-Type|3A| application/x-www-form-urlencoded"; http_header; pcre:"/(base64|data=|payload=|content=|c=|d=)/Ri"; threshold:type both, track by_src, count 1, seconds 60; classtype:policy-violation; reference:cve,2026-91788; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91788; metadata:service http; sid:202691788; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : ("FoxitPDFEditor.exe", "FoxitReader.exe", "FoxitPDFReader.exe") and
  process.command_line : ("*\\Downloads\\*", "*\\AppData\\Local\\Temp\\*", "*\\Temp\\*", "*\\\\*")

network where process.name : ("FoxitPDFEditor.exe", "FoxitReader.exe", "FoxitPDFReader.exe") and
  destination.ip != null and
  not destination.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")

Splunk SPL Query

index=sysmon (EventCode=1 OR EventCode=3 OR EventCode=22)
| eval proc=lower(Image)
| where match(proc,"foxit(pdfeditor|reader|pdfreader)\.exe")
| eval is_net=if(EventCode=3 OR EventCode=22,1,0)
| eval is_susp_open=if(match(CommandLine,"(?i)(\\Downloads\\|\\AppData\\Local\\Temp\\|\\\\[^\\]+\\[^\\]+)"),1,0)
| where is_net=1 OR is_susp_open=1
| stats count values(DestinationIp) as dests values(CommandLine) as cmds by Computer, User, proc
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91788,">
  <rule id="100788" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">(?i)Foxit(PDFEditor|Reader|PDFReader)\.exe</field>
    <field name="win.eventdata.commandLine">(?i)(\\Downloads\\|\\AppData\\Local\\Temp\\|\\\\[^\\]+\\[^\\]+)</field>
    <description>CVE-2026-91788: Foxit PDF application opened a document from an untrusted or remote path (possible cross-document data theft)</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>attack,collection,</group>
  </rule>

  <rule id="100789" level="12">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">(?i)Foxit(PDFEditor|Reader|PDFReader)\.exe</field>
    <field name="win.eventdata.destinationIp">\.</field>
    <description>CVE-2026-91788: Foxit PDF application initiated an external network connection (possible exfiltration of cross-document content)</description>
    <mitre>
      <id>T1041</id>
    </mitre>
    <group>attack,exfiltration,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Disable JavaScript execution in Foxit PDF Editor/Reader by default. This is the single most effective control, since the entire attack chain depends on the embedded scripting interface.
• Configure Foxit to open documents in separate processes, if supported, to reduce cross-document in-process exposure.
• Block or sandbox inbound PDFs from untrusted sources at the email gateway and web proxy; strip or neutralize embedded JavaScript in PDFs where possible.
• Enforce least privilege for users who routinely open untrusted PDFs; deploy application isolation/containment for the Foxit process.
• Increase user awareness: one opened malicious PDF is sufficient (UI:R); discourage opening unsolicited attachments.

2) Patch/upgrade steps

• No patch is currently available from any tracked source. Monitor the Foxit security advisory and release notes channels continuously.
• When a fixed build is published, inventory all endpoints running Foxit PDF Editor/Reader using endpoint management tooling, then deploy the vendor update through your standard software deployment pipeline. Validate the updated build version on a pilot ring before broad rollout.

3) Long-term hardening

• Maintain a software inventory and patch SLAs for productivity/document applications, which are frequently outside standard browser/OS patch cycles.
• Adopt PDF allowlisting or CDR (content disarm and reconstruction) in high-sensitivity document workflows.
• Segment and monitor egress: restrict where document applications may connect, and alert on external connections originating from document viewers.
• Track CVE data for Foxit and comparable PDF readers; leverage EPSS once scores become available to refine prioritization.

References

1. NVD — CVE-2026-91788: https://nvd.nist.gov/vuln/detail/CVE-2026-91788
2. Foxit Security Advisories: https://www.foxit.com/support/security-bulletins.html
3. CWE-668 — Exposure of Resource to Wrong Sphere: https://cwe.mitre.org/data/definitions/668.html
4. MITRE ATT&CK — T1204.002 User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-91788 not listed as of this report date)

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91788 in the available data; no public PoC, exploit code, or Nuclei template exists.