CVE-2026-91791

Executive Summary

CVE-2026-91791 is a use-after-free (CWE-416) vulnerability in Foxit PDF Editor and Foxit PDF Reader that is triggered when a specially crafted PDF file causes a reentrant JavaScript execution path via page-visibility events. During annotation boundary calculation, the application can access a page-view object that has already been released, producing an invalid memory read and an application crash. The CVSS 3.1 base score is 7.8 (High), and no patch, PoC, exploit code, or vendor advisory is currently available from tracked sources.

Technical Analysis

The vulnerability class is a use-after-free (CWE-416). Per the NVD description, the flaw manifests during the processing of a specially crafted PDF file: the document drives a reentrant execution condition in which JavaScript is invoked through page-visibility events. Reentrancy is the core enabler — while the application is executing one code path, a page-visibility event synchronously re-enters the JavaScript engine and, by extension, document/annotation processing logic. This reentrant path leads the application to reference a page-view object that has already been freed, specifically while it is calculating annotation boundaries. The consequence described is an invalid memory read followed by an application crash.

Two distinct subsystems are implicated by the description: (1) the PDF JavaScript engine as reached through page-visibility events, and (2) the annotation boundary calculation logic that dereferences the page-view object. The defect is a lifetime-management failure — the page-view object is released, and a subsequent access path does not validate that the reference remains live before the annotation boundary calculation reads from it.

The attack surface is the document-parsing pipeline of Foxit PDF Editor and Foxit PDF Reader. Exploitation requires the target to open a malicious PDF, so the attack vector is local (AV:L) with user interaction required (UI:R). No privileges are required (PR:N), and the scope is unchanged (S:U).

It is important to be explicit about what is and is not known. The NVD description does not name the specific JavaScript API call, event handler name, or internal function involved in the page-visibility callback, nor does it name the annotation boundary calculation routine or the page-view object type. Those specifics cannot be asserted here. What is derivable is the mechanism class: a reentrancy-induced dangling reference to a page-view object consumed by annotation boundary calculation. The current description characterizes the outcome as an invalid memory read and application crash; it does not describe a proven write primitive, controlled heap grooming, or a demonstrated code-execution chain.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (use-after-free via reentrant JavaScript-triggered event handling) and from the NVD description. No specific function names, event names, JavaScript APIs, or internal object identifiers are asserted, because the available description does not provide them.

1. Reconnaissance / target identification. An attacker identifies a target population that uses Foxit PDF Editor or Foxit PDF Reader to open untrusted PDF documents — for example, employees receiving external email attachments, or users retrieving documents from public web locations. Because the vector is AV:L with UI:R, the attacker's objective at this stage is simply to get the crafted document onto a victim host and persuade the user to open it.

2. Triggering the flaw class. The attacker authors or obtains a PDF whose content causes page-visibility events to fire in a manner that synchronously re-enters the JavaScript engine. The reentrant path interacts with annotation processing such that, while annotation boundaries are being calculated, the code accesses a page-view object that has already been released. The precise trigger content — which page-visibility event, which document structure, and which document-scripting constructs are required — is not specified in the available description and is not invented here.

3. Payload / execution method at the vulnerability-class level. The delivery vehicle is the PDF file itself; the "payload" is the document content that induces the reentrant execution ordering. For use-after-free classes generally, exploitation attempts to influence the contents of the freed memory region (heap grooming/feng shui) so that the dangling reference resolves to attacker-influenced data rather than invalid memory. The NVD description for this CVE documents only an invalid memory read and crash, not attacker control of the freed allocation; therefore weaponization to code execution should be treated as theoretical for this specific CVE absent further research. The realistic near-term outcome is a denial-of-service condition (application crash) triggered by document open.

4. Post-exploitation impact. Based strictly on the described outcome, the immediate effect is an application crash — a local denial-of-service for the user session processing the document. If a future analysis establishes control over the freed page-view object, the same primitive could be extended toward memory corruption; however, no such control is described in the available data, and no exploit-in-the-wild or KEV listing exists.

Impact Assessment

The CVSS 3.1 base score is 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Subscore interpretation: Attack Vector Local — the attacker must deliver a file to the target host and have it opened rather than exploiting a remote service directly. Attack Complexity Low — no described preconditions beyond delivering the crafted document. Privileges Required None and User Interaction Required — the victim must open the malicious PDF. Scope Unchanged — impact is confined to the vulnerable application context. The Confidentiality, Integrity, and Availability subscores are all High in the assigned vector, reflecting the potential of a use-after-free primitive to affect memory contents; note that the NVD narrative currently documents only an invalid memory read and crash, so the High C/I/A ratings should be read as the vector's upper-bound characterization of the vulnerability class rather than evidence of demonstrated exploitation outcomes.

Affected systems are endpoints running Foxit PDF Editor or Foxit PDF Reader, including enterprise workstations and any environment where untrusted PDFs are routinely opened. Blast radius per successful trigger is limited to the user session and the Foxit process — the flaw is not remotely reachable without user action and is not a server-side or wormable condition. Operational impact is therefore concentrated in user productivity disruption (crash on document open) and in document-handling workflows, with heightened risk in organizations that process large volumes of external PDF content (legal, finance, HR, procurement). Because there is no patch evidence from any tracked source (patch confidence 0/4), exposure persists until a vendor fix is identified.

Detection Guidance

Note: detection content below targets the exploitation pattern at the vulnerability-class level — anomalous PDF scripting that drives page-visibility reentrancy and Foxit process crashes. Because no specific event names, APIs, or file paths are provided in the source data, the rules deliberately rely on behavioral and structural indicators rather than fabricated identifiers.

Sigma Rule

title: Suspicious Foxit PDF Reader/Editor Crash on Document Open (CVE-2026-91791 UAF Pattern)
id: 8b1f4c2e-9179-4a6d-9f31-cve202691791
status: experimental
description: Detects Foxit PDF Editor/Reader process termination consistent with a use-after-free crash while opening a crafted PDF, potentially triggered by reentrant JavaScript page-visibility events.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91791
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1203
  - cve.2026-91791
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\Foxit Reader.exe'
  selection_crash:
    - ExitCode: '0xC0000005'
    - ExitCode: '-1073741819'
    - ExitCode: '3221225477'
  condition: selection_image and selection_crash
falsepositives:
  - Legitimate Foxit crashes unrelated to malicious documents
  - General application instability on the endpoint
level: medium

YARA Rule

rule PDF_JS_PageVisibility_Reentrancy_Indicators
{
    meta:
        description = "Detects PDF documents containing JavaScript page-visibility event handlers combined with annotation objects, an indicator pattern for CVE-2026-91791 (Foxit use-after-free via reentrant JavaScript)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91791"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pdf_header = { 25 50 44 46 2D }              // %PDF-
        $js_openaction = "/OpenAction" ascii
        $js_javascript = "/JavaScript" ascii
        $js_js = "/JS" ascii
        $evt_pagevis1 = "/PageVisible" ascii
        $evt_pagevis2 = "/PageOpen" ascii
        $evt_pagevis3 = "/PageClose" ascii
        $annot = "/Annots" ascii
        $annottype = "/Subtype /Widget" ascii

    condition:
        $pdf_header at 0 and
        ($js_openaction or $js_javascript or $js_js) and
        ($evt_pagevis1 or $evt_pagevis2 or $evt_pagevis3) and
        $annot
}

Suricata IDS Rule

alert http any any -> any any (msg:"FILE-PDF Foxit CVE-2026-91791 possible exploit PDF with page-visibility JavaScript and annotations"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/JavaScript"; nocase; content:"/Annots"; nocase; pcre:"/(\/PageVisible|\/PageOpen|\/PageClose)/"; filestore; sid:9179101; rev:1; metadata:cve CVE-2026-91791, created_at 2026_01_01; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91791;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ process where process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "Foxit Reader.exe") and event.type == "start" ]
  [ process where process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "Foxit Reader.exe") and event.type == "end" and process.exit_code in (3221225477, -1073741819, 0xC0000005) ]

Splunk SPL Query

index=endpoint (Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe" OR Image="*\\Foxit Reader.exe")
| eval is_crash = if(ExitCode="3221225477" OR ExitCode="-1073741819" OR ExitCode="0xC0000005", 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, is_crash
| where is_crash=1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,foxit,cve-2026-91791,">
  <rule id="917910" level="6">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.image">(?i)FoxitPDFReader\.exe|FoxitPDFEditor\.exe|Foxit Reader\.exe</field>
    <description>Foxit PDF Reader/Editor executed - potential CVE-2026-91791 crafted PDF handling</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <rule id="917911" level="10">
    <if_sid>917910</if_sid>
    <field name="win.eventdata.exitCode">3221225477|-1073741819|0xC0000005</field>
    <description>Foxit PDF process terminated with access violation exit code (possible CVE-2026-91791 use-after-free crash)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range has been supplied by any tracked source. The guidance below is defensive and does not depend on an available patch.

1. Immediate mitigations.

• Treat untrusted PDF files as hostile. Enforce attachment filtering and content disarm and reconstruction (CDR) at the email and web gateways so that active content — particularly document JavaScript and dynamic actions — is stripped before delivery.
• Where Foxit deployment policy allows, disable JavaScript execution in Foxit PDF Editor/Reader so that the reentrant page-visibility code path described in this CVE cannot be entered. Validate the exact setting name against your deployed Foxit build documentation before rolling out, as the setting is not specified in the CVE data provided.
• Restrict PDF opening to a sandboxed/isolated viewer or an isolated virtual machine for high-risk user populations (executives, finance, HR, legal) that receive external documents.
• Block or quarantine externally sourced PDFs that contain both JavaScript and annotation structures until they have been reviewed.

2. Patch / upgrade steps.

• Monitor the Foxit security advisory and release-notes channels for a fix addressing CVE-2026-91791. No patch reference exists at the time of writing.
• Establish a tracked inventory of Foxit PDF Editor/Reader installations (version and build) so that remediation can be applied promptly when a fixed build is published.
• When a fix is released, prioritize endpoints that routinely open untrusted PDFs, and verify the deployed build post-upgrade.

3. Long-term hardening.

• Maintain a software bill of materials for endpoint document-viewer software and centralize patch management for third-party PDF readers.
• Apply application allow-listing and endpoint detection coverage for document-viewer crash telemetry, which is the most reliable available signal for this class of flaw.
• Adopt least-privilege endpoint configurations and OS-level exploit mitigations (ASLR, DEP/CFG, heap hardening) to raise the bar for any future weaponization of a use-after-free primitive in this component.
• Retain the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh detections above and tune them against your environment's normal Foxit crash baseline.

References

• NVD — CVE-2026-91791: https://nvd.nist.gov/vuln/detail/CVE-2026-91791
• CWE-416 Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Foxit Security Advisories (vendor advisory portal — no CVE-2026-91791 entry confirmed at time of writing): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91791 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign and exploit-in-the-wild evidence: none available. CISA KEV status is NO, no public PoC or exploit code is tracked, and no Nuclei template exists for this CVE.