CVE-2026-91792

Executive Summary

CVE-2026-91792 is a use-after-free (CWE-416) vulnerability in Foxit PDF Editor and Foxit Reader that is triggered when the application processes a specially crafted PDF file. According to the NVD description, page- and annotation-related JavaScript actions can cause reentrant zoom and layout operations that lead the application to access page objects after they have been released. Successful exploitation requires user interaction (opening a malicious PDF) but, per the CVSS assessment, may result in high confidentiality, integrity, and availability impact on the affected host. As of this report, no public proof-of-concept, exploit code, or vendor patch has been identified, leaving affected users without an official remediation path.

The vulnerability is scored 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — a local attack vector that in practice is delivered through the classic client-side file-opening scenario. Because Foxit Reader and PDF Editor are widely deployed in enterprise document workflows (legal, finance, healthcare, government), any exploitable memory-corruption issue in their JavaScript/rendering engine represents a meaningful risk of document-borne compromise.

This report synthesizes what is knowable from the CVE record and the vulnerability class. Where the NVD description is sparse, analysis stays at the vulnerability-class level and avoids fabricating implementation details. Enterprise defenders should treat CVE-2026-91792 as an unpatched client-side memory-corruption bug requiring compensating controls (attack-surface reduction and detection) rather than relying on a vendor fix.

Technical Analysis

CVE-2026-91792 is classified as CWE-416, Use After Free. The NVD description states that when processing a "specially crafted PDF," Foxit PDF Editor/Reader "may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions." The consequence is that the application "access[es] page objects after they have been released," resulting in a use-after-free condition and an application crash.

The essential mechanics of this bug class are well understood and can be reasoned about without inventing product internals:

1. Object lifetime in a scriptable document engine. PDF readers expose a JavaScript API that lets document authors attach scripts to pages and annotations. A PDF is not static; the embedded JavaScript can fire on events such as document open, page open/close, and annotation interactions, and it can request rendering-adjacent operations such as changing the zoom level or triggering a layout recalculation.

2. Reentrancy. "Reentrant" operations are those that re-enter engine code while an outer operation is still executing. The description indicates that page- and annotation-related JavaScript actions can drive zoom and layout operations reentrantly — i.e., while the reader is already mid-way through processing page objects.

3. Premature object release. During reentrant zoom/layout handling, the engine releases (frees) page objects — presumably as part of rebuilding or invalidating a page's layout tree. If a subsequent, still-pending reference to a previously valid page object is dereferenced after that release, the result is a use-after-free: the pointer targets memory that has been reclaimed (and may be reused or reallocated with attacker-influenced content).

4. Impact of the UAF. The CVE record documents the immediate consequence as an application crash. In memory-corruption vulnerabilities, a crash is often the most benign outcome; the more serious risk — consistent with the CVSS confidentiality/integrity/availability (C:H/I:H/A:H) score — is that an attacker can influence the contents of the freed memory before it is dereferenced, converting a crash primitive into code execution or information disclosure within the reader process. The NVD description stops at "application crash," so the exploitability beyond denial of service should be treated as potential, not confirmed.

Attack surface. The attack surface is the document-parsing and JavaScript-execution pipeline of Foxit PDF Editor/Reader. The trigger is a crafted PDF containing:

• page-related JavaScript actions, and
• annotation-related JavaScript actions, that together induce reentrant zoom and layout work. No URL endpoints, file paths, function names, or API parameters are specified in the CVE record, so the report does not name any.

Why the bug exists (class-level). Use-after-free in a reentrant rendering engine typically stems from missing synchronization or missing lifetime guards: an outer routine assumes it owns a page object, an inner (reentrant) routine frees or replaces that object, and the outer routine later uses the stale reference. Robust designs use reference counting, reentrancy guards, or deferred deletion. The CVE record is consistent with the absence of such a guard in the zoom/layout path when driven from page/annotation scripts.

Severity reasoning. AV:L + UI:R reflects that the attacker must get the victim to open a local file (or a downloaded one) — the attack is not remotely triggerable without user action. Once triggered, AC:L reflects low exploitation complexity in the CVSS model, and C:H/I:H/A:H reflects the assessed worst-case impact on the host process and its data. Note: no EPSS score has been assigned by FIRST.org, and CISA KEV does not list this CVE, so there is no confirmed exploitation in the wild at the time of writing.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-91792. The attack chain below is inferred strictly from the vulnerability class (use-after-free via reentrant JavaScript-driven zoom/layout in a PDF reader) and from the NVD description. It deliberately avoids naming functions, methods, or parameters not present in the source data.

1) Reconnaissance / target identification. The attacker does not need network access to the victim's reader. Reconnaissance focuses on identifying targets that use Foxit PDF Editor/Reader to open untrusted documents (e.g., email attachments, downloaded invoices/contracts, web-hosted PDFs). The attacker assembles a distribution channel — phishing email with a PDF attachment, a malicious link that serves a PDF, or a compromised legitimate site hosting a document.

2) Triggering the flaw class. The attacker authors a PDF that embeds JavaScript associated with pages and annotations. Per the CVE record, when such a document is opened, the embedded actions cause the reader to perform reentrant zoom and layout operations. The reentrancy leads the engine to release page objects while an outer operation still holds references to them; when those stale references are subsequently used, a use-after-free occurs.

3) Payload / execution method (class level). The delivery vehicle is the PDF itself. The malicious document is provided to the victim and opened with Foxit PDF Editor/Reader (UI:R). The JavaScript-driven reentrancy is the mechanism that produces the dangling pointer. Depending on the exact memory layout — which is not documented in the CVE record — the outcome may be a crash (as stated) or, potentially, attacker-influenced memory reuse leading to further impact. Because no exploit code exists publicly, any step beyond "application crash" is speculative and should be validated by the vendor or independent researchers.

4) Post-exploitation impact. In the documented, confirmed scenario, the user experiences an application crash (denial of service / availability impact). In the assessed worst case — consistent with the C:H/I:H/A:H CVSS subscores — a refined exploit could execute code in the context of the reader process, read document or in-memory data, or corrupt data. Because the reader commonly runs as the logged-in user with access to local files and, in some configurations, enterprise document repositories, such an outcome could enable further lateral movement or data theft from the endpoint.

Realism caveat. Given the absence of PoC, the most defensible statement is: the confirmed outcome is a reader crash; the theoretical outcome is code execution. Defenders should plan for both.

Impact Assessment

Business impact. Foxit PDF Editor and Reader are mainstream enterprise document clients. A document-borne use-after-free that can crash the reader creates immediate availability risk (lost work, interrupted document review) and, if weaponized, a potential endpoint-compromise vector. Legal, financial, healthcare, and government organizations that routinely open third-party PDFs are most exposed because their workflows inherently trust inbound documents.

Affected systems. Systems running Foxit PDF Editor or Foxit Reader on endpoints where users open PDFs — desktops, laptops, VDI sessions, and any host where the reader is the default PDF handler. The CVE record does not enumerate specific affected versions, and no OSV package data is available, so a precise version matrix cannot be provided; administrators should inventory installed Foxit builds and consult the vendor directly.

Blast radius. Per-victim host, scoped to the user context of the reader process. It is not a server-side or network-perimeter vulnerability. The blast radius scales with how many endpoints run the reader and how often they open untrusted PDFs.

CVSS subscores. Base 7.8 High. AV:L (local delivery) and UI:R (victim must open the file) temper exploitability; AC:L (low complexity), PR:N (no privileges required), S:U (unchanged scope), and C:H/I:H/A:H (high impact across confidentiality, integrity, availability) drive severity upward. In the CVSS framework, high C/I/A with unchanged scope on a client routinely maps to code-execution risk in the host user's context.

Threat-actor context. No KEV listing, no EPSS score, and no public exploit references are available. There is no evidence of active exploitation or attributed campaigns. This is a "watch and harden" item rather than an active-incident item — but client-side UAFs in ubiquitous document readers historically attract both commodity and targeted actors, so monitoring should be proactive.

Detection Guidance

Detection for a file-borne PDF reader bug blends endpoint (process/file/behavior) telemetry with network telemetry for PDF delivery. The rules below are generic to the vulnerability class and avoid asserting IOCs that do not exist for this CVE.

Sigma Rule

title: Suspicious PDF Reader Crash or JavaScript-Driven Reentrancy (CVE-2026-91792)
id: 7b9e2c14-0f3a-4c2e-9a6d-1e5f0c8d3a21
status: experimental
description: Detects Foxit PDF Editor/Reader process crashes and repeated PDF open events consistent with a use-after-free triggered by crafted PDF JavaScript (CVE-2026-91792).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91792
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
      - '\Foxit\FoxitPDFEditor\FoxitPDFEditor.exe'
      - '\Foxit Reader\FoxitReader.exe'
  selection_crash:
    # Windows Error Reporting / application crash artifacts
    CommandLine|contains:
      - 'WerFault'
      - 'AppCrash'
  condition: selection_image and selection_crash
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate reader crashes unrelated to exploitation
  - Software updates that restart the reader
level: medium
tags:
  - attack.t1203
  - cve.2026.91792

YARA Rule

rule PDF_Foxit_Reentrant_Zoom_Layout_JS_UAF_CVE_2026_91792
{
    meta:
        description = "Detects PDFs embedding page/annotation JavaScript that drives zoom/layout operations, consistent with CVE-2026-91792 use-after-free in Foxit Reader/Editor"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91792"
        cve = "CVE-2026-91792"
        severity = "high"

    strings:
        $pdf = "%PDF-"
        $js1 = "/JavaScript" ascii nocase
        $js2 = "/JS" ascii
        $openaction = "/OpenAction" ascii nocase
        $aa = "/AA" ascii
        $annot = "/Annot" ascii nocase
        $zoom = "zoom" ascii nocase
        $layout = "layout" ascii nocase
        $pageopen = "PageOpen" ascii nocase
        $pageclose = "PageClose" ascii nocase

    condition:
        $pdf at 0 and
        ( $js1 or $js2 ) and
        ( $openaction or $aa ) and
        $annot and
        ( $zoom or $layout or $pageopen or $pageclose )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91792 Possible Foxit PDF JavaScript PDF Download"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/JavaScript"; nocase; filemagic:"PDF document"; filestore; sid:202691792; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_91792; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91792;)

Elastic Detection

process where event.type == "start" and
process.parent.name in ("FoxitPDFEditor.exe", "FoxitReader.exe") and
process.name in ("WerFault.exe", "werfault.exe") and
process.args : "*Foxit*"

Splunk SPL Query

index=wineventlog (EventCode=1000 OR EventCode=1001)
| where match(faulting_application, "(?i)Foxit(Reader|PDFEditor)\.exe")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(faulting_module) as modules by host, faulting_application, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="windows,foxit,cve_2026_91792,">
  <rule id="100792" level="10">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">^Application Error$</field>
    <field name="win.system.message">Foxit</field>
    <match>FoxitReader\.exe|FoxitPDFEditor\.exe</match>
    <description>CVE-2026-91792: Foxit PDF Reader/Editor application crash - possible use-after-free exploitation attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_91792,</group>
  </rule>
</group>

Detection rationale. Because the CVE has no publicly known IOCs, detections target (a) crash telemetry for the Foxit processes (the confirmed outcome), (b) PDF delivery over HTTP with embedded JavaScript (the delivery mechanism), and (c) file-content signatures for PDFs combining page/annotation JavaScript with zoom/layout actions (the trigger class). Correlate repeated Foxit crashes on a single host or with inbound email-borne PDFs as an escalation signal.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, advisory, or vendor fix has been identified from any tracked source. No affected-version range or OSV package data is available. Until Foxit publishes a fix, compensating controls are the only defense.

1) Immediate mitigations.

• Reduce attack surface: disable or restrict JavaScript execution in Foxit PDF Editor/Reader where policy allows. Many enterprise document workflows do not legitimately require embedded JavaScript.
• Configure the reader to not open untrusted or internet-sourced PDFs automatically; enforce "ask before opening" for external documents.
• Isolate document opening: run the reader in a sandbox, low-privilege context, or an application-isolation/container environment; consider opening untrusted PDFs in a disposable VM or a hardened alternate viewer.
• Email and web gateway controls: strip or quarantine PDF attachments containing embedded JavaScript from untrusted senders; block direct PDF downloads from newly registered or low-reputation domains.
• Restrict outbound network egress from endpoints that run the reader, to blunt any post-exploitation callback if the UAF is weaponized beyond a crash.
• Enforce endpoint protection with exploit-mitigation features (heap/ASLR hardening, EDR memory-corruption heuristics).

2) Patch / upgrade steps.

• Inventory installed Foxit builds across the estate (EDR, software inventory, patch management).
• Monitor the Foxit security advisory channel and the NVD CVE-2026-91792 record for a fixed version. When available, prioritize upgrades on endpoints that open third-party PDFs.
• Because no fixed version is published, do not assume "latest" equals "fixed." Validate the specific build against the vendor advisory before declaring remediation.
• Until a patch exists, treat the CVE as accepted-risk-with-mitigations and document the compensating controls in the risk register.

3) Long-term hardening.

• Standardize on an approved PDF viewer with a strong JavaScript sandboxing posture and rapid patch cadence, or enforce JavaScript-free viewing for inbound documents.
• Maintain a vulnerability management process with SLA for client-side document readers; track CISA KEV and vendor advisories centrally.
• Deploy document detonation (sandbox analysis) for inbound PDFs so that JavaScript-driven rendering exploits are exercised in an isolated environment before reaching users.
• Continuously tune the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh detections above, and add host-based memory-corruption detections to catch exploitation beyond the crash primitive.
• Train users to treat unexpected PDF attachments and download prompts with skepticism.

References

• NVD — CVE-2026-91792: https://nvd.nist.gov/vuln/detail/CVE-2026-91792
• MITRE CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Foxit Security Advisories (monitor for a fixed-version advisory referencing CVE-2026-91792): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91792 not currently listed; verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91792 at the time of this report. No public PoC, exploit code, or Nuclei template is available.