CVE-2026-91789

Executive Summary

CVE-2026-91789 is an out-of-bounds write (CWE-787) in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit Reader. Insufficient validation of image dimensions and related size information can cause an incorrectly sized memory allocation, leading to an out-of-bounds write during pixel processing. Exploitation requires a user to open a crafted document containing a malicious 3D (U3D) or GIF asset, and a successful attack may result in remote code execution with the privileges of the affected process.

Technical Analysis

The vulnerability resides in the component of Foxit PDF Editor/Reader that decodes texture data from U3D (Universal 3D) assets and GIF images. According to the NVD description, this decoding path "contained insufficient validation of image dimensions and related size information." When dimension and size fields are not validated against the actual buffer or allocation constraints, the decoder can compute an incorrect allocation size. Pixel processing then operates on data that exceeds the bounds of the allocated buffer, producing an out-of-bounds write.

The flaw class is CWE-787 (Out-of-bounds Write). The essential mechanics are consistent and well understood for this weakness class:

1. Untrusted input supplies dimension and size metadata that the decoder trusts.
2. A size calculation (typically width × height × bytes-per-pixel or similar) is performed without adequate bounds checking, or using values that do not reflect the true data length.
3. Memory is allocated based on the incorrect size.
4. Pixel/texture processing writes beyond the allocated region, corrupting adjacent memory.
5. If attacker-controlled data reaches the corrupted region in a controlled manner, execution flow can be redirected, potentially resulting in code execution.

Important accuracy note: the advisory data available for this CVE does not disclose the specific function names, file paths, parameter names, or exact field offsets involved. No public proof-of-concept, exploit code, or Nuclei template was identified at the time of writing. Any statement beyond the vulnerability class and the affected decoding path (U3D/GIF texture handling) would be speculation. The attack surface is the document parsing pipeline: a Foxit product opening a PDF (or associated asset) that embeds a U3D 3D object or a GIF image.

Exploitation Scenarios

No public PoC available; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function, endpoint, or parameter names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. An adversary identifies users or organizations running vulnerable Foxit PDF Editor/Reader. Because the CVSS vector is AV:L with UI:R, the attacker does not need network reachability to the victim host; they need to deliver a file the user will open. Targets are typically selected based on known document workflows (engineering, architecture, finance, government) where PDF and 3D content are exchanged routinely.

2. Triggering the flaw. The attacker crafts a PDF or referenced asset containing a U3D 3D object or GIF image whose declared image dimensions and size metadata are inconsistent with the actual pixel data. When the victim opens the document, the texture decoding path in Foxit processes the malformed asset. Insufficient validation of the dimensions and size information causes an incorrectly sized memory allocation, and pixel processing writes past the end of that allocation (out-of-bounds write).

3. Execution method at the vulnerability-class level. The out-of-bounds write corrupts adjacent heap memory. The attacker's objective is to shape the heap layout so that metadata subsequently used by the process (for example, a pointer or length value) is overwritten with attacker-controlled data, leading to control-flow diversion and ultimately code execution. The specific primitives required to convert the write into reliable code execution are not described in the available advisory and are not asserted here.

4. Post-exploitation impact. Per the CVSS vector, successful exploitation yields High confidentiality, High integrity, and High availability impact with unchanged scope (S:U). In practice, code executes in the context of the Foxit process. If the user runs Foxit with elevated privileges or the process can be leveraged for lateral movement within the host session, impact extends to the host. The user interaction requirement (UI:R) and local attack vector (AV:L) mean initial access is typically achieved through social engineering, email attachment, or malicious download rather than remote network exploitation.

Impact Assessment

CVSS 3.1 base score 7.8 (High). Subscore breakdown:

• Attack Vector: Local (AV:L) — the attacker must deliver a file to the victim, not reach the vulnerable service directly over the network.
• Attack Complexity: Low (AC:L) — no special conditions beyond crafting the malformed asset are described.
• Privileges Required: None (PR:N) — the attacker does not need prior access to the target system.
• User Interaction: Required (UI:R) — the victim must open the crafted document.
• Scope: Unchanged (S:U) — the vulnerable component's security authority is not exceeded per the CVSS definition.
• Confidentiality: High (C:H), Integrity: High (I:H), Availability: High (A:H) — full compromise of the affected process's data, integrity, and availability.

Business impact: Foxit PDF Editor and Reader are widely deployed in enterprises as alternatives or complements to Adobe Acrobat. A code-execution flaw in the document parsing path is a high-value target for phishing-based initial access and can lead to credential theft, ransomware staging, or persistent footholds. The blast radius is any endpoint where a user opens an untrusted PDF containing U3D or GIF content. Because no patch is available (patch confidence 0/4) and the CVE is not in CISA KEV, defenders must rely on mitigation and detection rather than patching.

Detection Guidance

Sigma Rule

title: Suspicious Foxit PDF Reader/Editor Child Process Execution
id: 7c3f9a12-4b8e-4d21-9f0a-1e2d3c4b5a60
status: experimental
description: Detects Foxit PDF Editor/Reader spawning shell or script interpreters, consistent with post-exploitation activity following CVE-2026-91789 out-of-bounds write.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91789
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Foxit plug-ins or updaters that invoke script hosts
level: high
tags:
  - attack.t1203
  - cve.2026-91789

YARA Rule

rule CVE_2026_91789_Foxit_U3D_GIF_Texture_OOB
{
    meta:
        description = "Heuristic detection of malformed U3D/GIF texture assets consistent with CVE-2026-91789 in Foxit PDF Editor/Reader. Detects GIF headers and embedded U3D markers for triage."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91789"
        date = "2026-01-01"
        severity = "high"

    strings:
        $gif = { 47 49 46 38 39 61 }        // GIF89a header
        $gif87 = { 47 49 46 38 37 61 }      // GIF87a header
        $u3d = "U3D" ascii
        $pdf = "%PDF-" ascii

    condition:
        $pdf at 0 and ($gif or $gif87 or $u3d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91789 Possible Foxit U3D/GIF Texture Document Download"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"U3D"; distance:0; nocase; or content:"GIF89a"; nocase; sid:202691789; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-91789; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91789;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

Splunk SPL Query

index=sysmon EventCode=1
| where match(ParentImage, "(?i)Foxit(PDFReader|PDFEditor|Reader)\.exe$")
| where match(Image, "(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$")
| table _time, ComputerName, User, ParentImage, Image, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91789,">
  <rule id="100789" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)Foxit(PDFReader|PDFEditor|Reader)\.exe$</field>
    <field name="win.eventdata.image">(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$</field>
    <description>CVE-2026-91789: Suspicious child process spawned by Foxit PDF Editor/Reader - possible post-exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or fixed version has been identified. No affected version range has been published.

1. Immediate mitigations:

• Reduce exposure to untrusted documents: enforce attachment sandboxing/detonation for PDFs and block U3D/GIF-embedded PDFs from external senders where business policy permits.
• Disable JavaScript and untrusted content execution in Foxit where configuration options allow, and restrict opening of 3D/U3D content.
• Run Foxit PDF Editor/Reader with least privilege (non-administrative user context) to limit the impact of code execution.
• Apply OS-level exploit mitigations (ASLR, DEP, CFG, ACG/CIG where available) and Endpoint Detection and Response (EDR) memory protection.
• Isolate document rendering in a hardened VM or container for high-risk document review.
• Add detection coverage for Foxit spawning script interpreters or unusual child processes (see detection rules above).

2. Patch/upgrade steps:

• Monitor the Foxit Software security advisory page and NVD entry for CVE-2026-91789 for a fixed release. As of this writing, no patch is available.
• When a fixed version is published, upgrade Foxit PDF Editor and Foxit Reader to that version and verify the deployed build number across all endpoints.
• Maintain an accurate software inventory to ensure all instances (including portable and per-user installs) are updated.

3. Long-term hardening:

• Establish a phased PDF reader patching cadence and automated inventory for document-processing applications.
• Enforce application allowlisting so that only approved readers process untrusted documents.
• Deploy file-content inspection that inspects embedded U3D and GIF assets inside PDFs before delivery to endpoints.
• Conduct user awareness training on malicious attachments and document-based social engineering.
• Adopt a least-privilege model and continuous monitoring for anomalous child-process behavior from document readers.

References

1. NVD — CVE-2026-91789: https://nvd.nist.gov/vuln/detail/CVE-2026-91789
2. MITRE CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
3. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
4. Foxit Software Security Advisories: https://www.foxit.com/support/security-bulletins.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91789 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified for CVE-2026-91789 at the time of writing. It is not listed in CISA KEV. No associated threat actor campaign has been reported in the available data.