CVE-2026-91790

Executive Summary

CVE-2026-91790 is a use-after-free (UAF) vulnerability in Foxit PDF Editor and Foxit PDF Reader that is triggered when the product renders a page image containing image objects with malformed optional content attributes. Because the application fails to validate these attributes, it may dereference an already-freed internal data structure, resulting in memory corruption and a crash. The vulnerability carries a CVSS 3.1 base score of 7.8 (High) and requires user interaction to exploit, making it a client-side attack vector relevant to any organization whose users open untrusted PDF documents in Foxit software.

Technical Analysis

The vulnerability is classified as CWE-416 (Use After Free) and resides in the PDF page-image rendering path of Foxit PDF Editor and Foxit PDF Reader. Per the NVD description, the defect occurs specifically when the program renders a page image and encounters image objects whose optional content attributes are malformed. The application does not perform validation on these attributes before use. As a result of this missing validation, the program may access an internal data structure that has already been freed — a classic use-after-free condition.

Optional Content Groups (OCGs), often referred to as "layers" in the PDF specification, allow document authors to control the visibility of content. Image objects can carry optional content attributes that reference OCG membership and visibility state. When such attributes are malformed — for example structurally inconsistent, referencing invalid or absent content group entries, or otherwise violating expected invariants — the rendering logic receives input it was not designed to handle. The description states the program "fails to perform validation" on these attributes, and that the consequence is access to "an already-freed internal data structure." This indicates the rendering code frees an object (or a related structure) and then later dereferences a stale pointer to it due to the unvalidated attribute state, producing the UAF.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H provides the following breakdown:

• Attack Vector (AV): Local — the vulnerability is triggered through the local execution context of the client application when a document is opened, consistent with a client-side file-parsing flaw.
• Attack Complexity (AC): Low — no specialized conditions beyond delivering the malformed document.
• Privileges Required (PR): None — the attacker does not need credentials on the victim system.
• User Interaction (UI): Required — the victim must open the crafted PDF.
• Scope (S): Unchanged — the impact is confined to the vulnerable application's security context.
• Confidentiality (C): High, Integrity (I): High, Availability (A): High.

The High impact ratings across all three dimensions are significant. While the NVD description explicitly calls out a crash due to UAF, the CVSS scoring implies that, under the CVSS model, successful exploitation could result in loss of confidentiality, integrity, and availability — consistent with the memory-corruption class where an attacker who controls heap layout may achieve arbitrary read/write or code execution rather than a mere crash. Analysts should treat the crash as the minimum demonstrated outcome and the High CIA ratings as the assessed potential worst-case impact. The description does not provide specific function names, memory offsets, or code paths, so no implementation-level detail beyond the mechanism above should be assumed.

No affected version range, patch information, or vendor advisory has been provided in the available intelligence. The patch confidence is 0/4, and no public PoC, exploit code, or Nuclei template is currently available.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-91790; the attack chain below is inferred at the vulnerability-class level only. No specific function names, file paths, or API parameters are asserted because none are provided in the source description.

1. Reconnaissance / target identification. An attacker identifies targets that use Foxit PDF Editor or Foxit PDF Reader to open untrusted documents. This is a broad population of enterprise endpoints, since Foxit is a widely deployed PDF client. The attacker does not require prior access to the victim host; targeting is opportunistic or spear-phishing-driven.

2. Triggering the flaw class. The attacker crafts a PDF document containing a page image whose optional content attributes are malformed. The defining characteristic of the trigger is that the image object's optional content attributes violate the format the renderer expects. This document is delivered to the victim, for example via phishing email attachment or a download link.

3. Execution / payload method. When the victim opens the crafted document and the affected page is rendered, the software processes the malformed optional content attributes without validation. The rendering path then accesses an already-freed internal data structure, producing a use-after-free. At the vulnerability-class level, an attacker aiming beyond a crash would attempt to influence heap state (for example by controlling surrounding object allocations through additional document structures) so that the freed memory is reclaimed with attacker-influenced contents before the stale pointer is dereferenced. The source material does not describe any specific heap-grooming technique, so no particular method is asserted here.

4. Post-exploitation impact. The minimum observable outcome is an application crash, which already yields a denial-of-service condition on the endpoint. Given the High confidentiality, integrity, and availability ratings in the CVSS vector, the assessed potential impact is arbitrary code execution in the context of the Foxit process. Since the user must open the file (UI:R) and exploitation occurs locally (AV:L), the attacker's foothold would initially be the victim user's session; privilege escalation to system level would depend on the privileges of that session and is not specified in the available data.

Impact Assessment

The CVSS 3.1 base score is 7.8 (High). The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a locally triggered, low-complexity, no-privilege attack that nevertheless requires the victim to open a malicious document. Scope is unchanged, meaning evaluation assumes impact is contained within the vulnerable Foxit component's authorization context.

Business impact:

• Endpoint availability: Rendering the malformed document crashes the application, interrupting user workflows and potentially losing unsaved work.
• Potential endpoint compromise: The High CIA subscores mean that, under the CVSS model, exploitation could yield disclosure of sensitive data, modification of data, and full loss of availability within the affected context. If weaponized beyond a crash, this could lead to code execution on the victim endpoint, enabling further lateral movement or data theft, contingent on the attacker's ability to control heap state.

Blast radius: Any environment where Foxit PDF Editor or Foxit PDF Reader is used to open documents from untrusted or external sources. Because the attack requires user interaction and delivery of a crafted file, the primary blast radius is individual user endpoints rather than servers. There is no evidence in the provided data of a network-facing or unauthenticated remote attack surface.

Current threat status: CISA KEV — NO. EPSS — not yet scored by FIRST.org (no value fabricated). No public exploit code, PoC, or Nuclei template is available. There is no evidence of in-the-wild exploitation in the provided intelligence. The vulnerability is currently unpatched per tracked sources (0/4 patch confidence).

Detection Guidance

Because this is a client-side, document-triggered memory-corruption vulnerability, detection centers on: (a) endpoint crash telemetry from Foxit processes, (b) static inspection of inbound PDFs for malformed optional content attributes, and (c) file-delivery network telemetry. No specific exploit byte patterns are published, so the rules below target generic behavior (crashes and suspicious PDF delivery) and the UAF class.

Sigma Rule

title: Foxit PDF UAF Crash on Malformed Image Optional Content Rendering (CVE-2026-91790)
id: 5f2a9c1e-7b4d-4e6a-9c3f-1a2b3c4d5e6f
status: experimental
description: Detects application crash events for Foxit PDF Editor/Reader processes potentially related to CVE-2026-91790 use-after-free during page image rendering.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91790
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: windows
detection:
  selection_image:
    - Image|endswith:
        - '\FoxitPDFReader.exe'
        - '\FoxitPDFEditor.exe'
        - '\FoxitReader.exe'
    - Provider_Name|contains:
        - 'Application Error'
        - 'Windows Error Reporting'
  selection_crash:
    EventID:
      - 1000
      - 1001
    Data|contains:
      - 'Foxit'
      - '0xc0000005'
  condition: selection_image and selection_crash
fields:
  - Image
  - EventID
  - Data
falsepositives:
  - Legitimate Foxit crashes from unrelated rendering bugs
  - Corrupted but benign PDF documents
level: medium
tags:
  - attack.t1203
  - cve.2026.91790

YARA Rule

rule CVE_2026_91790_Foxit_Malformed_OCG_Image
{
    meta:
        description = "Heuristic detection of PDFs carrying image objects with malformed optional content attributes targeting Foxit PDF (CVE-2026-91790)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91790"
        cve = "CVE-2026-91790"

    strings:
        $pdf = "%PDF-"
        $oc = "/OC"
        $ocg = "/OCGs"
        $img = "/Image"
        $ocprops = "/OCProperties"
        $xobj = "/XObject"
        $subtype = "/Subtype"

    condition:
        $pdf at 0 and
        filesize < 50MB and
        $ocprops and
        $ocg and
        $oc and
        ($img or $xobj) and
        $subtype
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91790 Foxit PDF Malformed Optional Content Image Delivery"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/OCProperties"; content:"/OCGs"; content:"/Image"; distance:0; within:4000; content:"/OC"; distance:0; within:4000; filestore; sid:202691790; rev:1; reference:cve,2026-91790; classtype:attempted-user; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and
  process.args : "*.pdf"

// Companion EQL looking for crash telemetry
// sequence by host.id with maxspan=1m
//   [process where process.name : ("FoxitPDFReader.exe","FoxitPDFEditor.exe") and process.args : "*.pdf"]
//   [file where event.action == "deletion" and file.name : "*.dmp"]

Splunk SPL Query

index=endpoint (source="XmlWinEventLog:Application" OR source="WinEventLog:Application")
(EventCode=1000 OR EventCode=1001)
(Faulting_Application="FoxitPDFReader.exe" OR Faulting_Application="FoxitPDFEditor.exe" OR Faulting_Application="FoxitReader.exe"
 OR Message="*Foxit*")
| eval cve="CVE-2026-91790"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(Faulting_Module) as modules
        by host Faulting_Application
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91790,">
  <rule id="100790" level="8">
    <if_sid>61603</if_sid>
    <match>FoxitPDFReader.exe|FoxitPDFEditor.exe|FoxitReader.exe</match>
    <description>CVE-2026-91790: Possible Foxit PDF Editor/Reader use-after-free crash while rendering malformed image optional content</description>
    <options>no_full_log</options>
    <group>application_crash,pdf_client,pci_dss_10.6,</group>
  </rule>
  <rule id="100791" level="10">
    <if_sid>61603</if_sid>
    <match>Foxit</match>
    <match>0xc0000005</match>
    <description>CVE-2026-91790: Foxit PDF access violation (potential UAF) - investigate document source</description>
    <group>application_crash,pdf_client,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Avoid opening PDF documents from untrusted or unsolicited sources in Foxit PDF Editor/Reader until a fix is available.
• Where operationally feasible, use a different PDF viewer or a secure-viewing/isolated environment for untrusted documents, reducing exposure of the affected rendering path.
• Restrict attachment delivery via email gateway and enforce content-disarm-and-reconstruction (CDR) or attachment sandboxing to neutralize malformed optional content attributes in image objects before delivery.
• Monitor endpoint crash telemetry for repeated Foxit process crashes when opening PDFs; correlate affected documents for triage.
• Limit local user privileges where practical so that a potential code-execution outcome has reduced impact.

2. Patch / upgrade steps

• No patch or fixed version is currently available from tracked sources. Monitor the vendor (Foxit) security advisories and the NVD record for CVE-2026-91790 for the release of an updated version.
• Upon availability, upgrade Foxit PDF Editor and Foxit PDF Reader to the vendor-recommended fixed build and verify the applied version across the fleet.
• Re-enable normal document-handling workflows only after remediation is confirmed.

3. Long-term hardening

• Maintain an inventory of endpoints running Foxit products and enforce timely patching through centralized management.
• Apply least-privilege and application isolation (sandboxing) to document viewers to contain client-side memory-corruption outcomes.
• Extend detection coverage for PDF-parsing memory-corruption classes (CWE-416) across all document readers, not only Foxit.
• Incorporate PDF attachment handling into security awareness and phishing-defense procedures, since exploitation requires user interaction.

References

• NVD — CVE-2026-91790: https://nvd.nist.gov/vuln/detail/CVE-2026-91790
• MITRE CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
• FIRST.org EPSS — not yet scored for CVE-2026-91790 (no current score available)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-91790 not listed (CISA KEV: NO)
• Foxit Security Advisories (monitor for vendor fix): https://www.foxit.com/support/security-bulletins.html

No known threat actor campaigns or exploit-in-the-wild evidence is available for CVE-2026-91790 in the provided intelligence.