CVE-2026-91793

Executive Summary

CVE-2026-91793 is a use-after-free (CWE-416) vulnerability in Foxit PDF Editor and Foxit PDF Reader that is triggered when a user opens a specially crafted PDF file. The document causes the application to execute scripts that modify annotation rich-text attributes containing malformed font data; during the subsequent reconstruction of the annotation appearance, the application accesses an object after it has been released, causing a use-after-free and application crash. With a CVSS base score of 7.8 (High) and no vendor patch, no public proof-of-concept, and no CISA KEV listing currently available, the vulnerability represents a credible client-side risk to any organization whose users open untrusted PDFs in Foxit products.

Technical Analysis

CVE-2026-91793 resides in the PDF parsing and rendering pipeline of Foxit PDF Editor and Foxit PDF Reader. The vulnerability class is a use-after-free (CWE-416), a memory-safety defect in which a program continues to reference a heap object after that object has been freed, leaving a dangling pointer that can be dereferenced, corrupted, or reallocated by an attacker-controlled value.

The NVD description establishes the following causal chain:

1. A specially crafted PDF is opened by the victim in Foxit PDF Editor or Foxit PDF Reader.
2. The document causes scripts to execute. PDF supports embedded JavaScript, and scripting hooks can be attached to document events. The description confirms scripts are executed as part of the trigger path, but the specific scripting APIs, event handlers, or method names invoked are not disclosed in the available data.
3. Those scripts modify annotation rich-text attributes containing malformed font data. Annotation dictionaries in PDF can carry rich-text formatting, including font specification entries. The crafted document supplies font data that is malformed, meaning the parsed font structure does not conform to what the annotation appearance machinery expects.
4. During subsequent reconstruction of the annotation appearance, the application accesses an object after it has been released. Annotation appearance streams are regenerated when annotations are rendered, refreshed, or updated; the reconstruction path is where the freed object is dereferenced.
5. The result is a use-after-free condition and an application crash.

The attack surface is the local PDF file-open path. The vulnerable component is the annotation appearance reconstruction logic combined with the annotation rich-text/font handling path. Because the trigger requires the user to open a malicious file, the attack is user-interaction dependent (UI:R), and the CVSS vector places the attack vector at Local (AV:L), consistent with local file execution rather than a remotely reachable service.

Critically, no function names, class names, memory offsets, or specific PDF object identifiers are provided in the source data. Any such specifics would be speculative and are therefore deliberately omitted from this report. The description is sufficient to characterize the defect class and the general trigger sequence, but not to reconstruct a precise reproduction recipe.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates:

• AV:L — the attacker must deliver a file to the target host and have it opened locally.
• AC:L — no special conditions beyond the crafted document are required.
• PR:N — no privileges are required by the attacker to trigger the flaw.
• UI:R — a user must open the malicious PDF.
• S:U — the impact is scoped to the vulnerable application and its privileges.
• C:H / I:H / A:H — high confidentiality, integrity, and availability impact per the vector. Note that the NVD description explicitly mentions an application crash (availability impact); the high confidentiality and integrity ratings imply that the memory-corruption primitive is assessed as potentially exploitable for code execution or data disclosure, even though no public exploit exists.

The CWE mapping to CWE-416 is consistent with the described "accesses an object after it has been released" behavior. Use-after-free defects in document renderers are a well-understood class: because the freed heap chunk can be reallocated with attacker-influenced data, a sufficiently developed exploit can redirect execution. However, the available data does not confirm exploitability beyond a crash, and no PoC or exploit code is public.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-91793. The following attack chain is inferred from the vulnerability class (use-after-free triggered by a crafted document with scripted annotation manipulation) and from the trigger sequence stated in the NVD description. It does not rely on any invented implementation details.

1) Reconnaissance and target identification. The attacker identifies a target environment where Foxit PDF Editor or Foxit PDF Reader is deployed and where users routinely open PDF documents from external sources (email attachments, web downloads, shared drives). Because exploitation is local and user-interaction driven, value is highest where PDF ingestion is a normal business workflow — finance, legal, procurement, HR, and any document-heavy department. Public exposure of the vulnerability is limited to the CVE record itself; no version range has been published, so affected-version scoping currently depends on the vendor's eventual advisory.

2) Delivery and trigger of the specific flaw class. The attacker crafts a PDF that, when opened, causes scripts to execute and modify annotation rich-text attributes with malformed font data. The document is delivered to the victim through a normal channel (attachment, link, shared file). The user opening the file satisfies the UI:R precondition. The script execution and annotation modification steps are the write/state-manipulation primitives that prepare the malformed state.

3) Payload execution at the vulnerability-class level. Once the malformed font data is present in the annotation rich-text attributes, the application's annotation appearance reconstruction path re-renders the annotation. During that reconstruction it dereferences an object that has already been freed. This is the use-after-free window. In a weaponized variant, the attacker would seek to reclaim the freed heap chunk with controlled data so that the dangling reference resolves to attacker-controlled content; this is the standard exploitation strategy for CWE-416 and is the reason the CVSS vector assigns High confidentiality and integrity impact despite the confirmed crash outcome. Because no technical detail on heap layout, allocator behavior, or the specific freed object is available, the precise weaponization technique cannot be described without speculation.

4) Post-exploitation impact. In the confirmed scenario, the outcome is an application crash — a denial-of-service against the victim's PDF workflow and potential loss of unsaved document state. In a successful weaponized scenario consistent with the CVSS subscores, a use-after-free in a document renderer can be leveraged to achieve code execution in the context of the Foxit process, granting the attacker the user's privileges, enabling data theft from documents and the local system, and potentially serving as a foothold for further lateral movement. This second outcome is assessed as latent potential, not confirmed exploitability.

Impact Assessment

The CVSS 3.1 base score is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Confidentiality (High): The vector rates confidentiality impact as High. In a document-renderer use-after-free, this reflects the potential for memory disclosure or code execution leading to access to data beyond what the user intended to expose.
• Integrity (High): The vector rates integrity impact as High, consistent with the potential for arbitrary manipulation of process state if the memory-corruption primitive is successfully weaponized.
• Availability (High): The NVD description confirms an application crash, which is a direct availability impact (High) against the affected application instance.
• Scope (Unchanged): Impact is contained within the vulnerable application's security context; no privilege boundary crossing is asserted by the vector.
• Attack Vector (Local) and User Interaction (Required): Exploitation requires local file delivery and a user opening the crafted PDF. Mass exploitation would require broad delivery of a malicious document, but the relative ease of email-based document delivery keeps this class of attack attractive.

Affected systems and blast radius: Any endpoint or server running Foxit PDF Editor or Foxit PDF Reader that processes untrusted PDFs is potentially in scope. Because no affected version range has been published, organizations cannot currently enumerate vulnerable builds from authoritative data; they should assume all deployed versions are potentially affected until the vendor publishes an advisory. Multi-user shared workstations, document processing pipelines, and thick-client environments with Foxit installed as the default PDF handler increase exposure. No CISA KEV listing exists, so there is no confirmed evidence of active exploitation in the wild at the time of writing.

Detection Guidance

Detection for this vulnerability is challenging because the trigger is a local file-open operation rather than a network request. Defenses should combine host-based file and process telemetry with network egress monitoring for post-compromise behavior. The rules below are written to detect the exploitation class; tuning against a live Foxit environment is required, and no specific malicious PDF hashes are available.

Sigma Rule

title: Foxit PDF Editor/Reader Potential Use-After-Free Exploitation via Crafted PDF
id: 9f2c1a74-6b3e-4d51-9a0f-cve202691793
status: experimental
description: Detects Foxit PDF Editor or Foxit PDF Reader crashing or spawning suspicious child processes after opening a PDF, consistent with CVE-2026-91793 use-after-free triggering during annotation appearance reconstruction.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91793
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\FoxitPDFEditor.exe'
      - '\FoxitPDFReader.exe'
      - '\FoxitReader.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Foxit features launching external viewers or print handlers
level: high

YARA Rule

rule CVE_2026_91793_Foxit_Annot_RichText_Font_UAF
{
    meta:
        author = "valtersit.com"
        description = "Detects PDF files that combine embedded JavaScript, annotation rich-text handling, and embedded font data, consistent with the CVE-2026-91793 trigger path."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91793"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pdf_header = "%PDF-"
        $js1 = "/JavaScript" ascii nocase
        $js2 = "/JS" ascii nocase
        $js3 = "app.launchURL" ascii nocase
        $annot = "/Annots" ascii
        $annot_rich = "/RC" ascii
        $font = "/Font" ascii
        $fontfile = "/FontFile" ascii
        $fontdesc = "/FontDescriptor" ascii

    condition:
        $pdf_header at 0 and
        $annot and
        ($annot_rich or $font or $fontfile or $fontdesc) and
        any of ($js*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91793 Possible Foxit PDF Crafted File Download (annotation rich-text font UAF)"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/Annots"; content:"/Font"; content:"/JavaScript"; nocase; filemagic:"PDF document"; filestore; sid:9009179301; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-91793; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91793;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("FoxitPDFEditor.exe", "FoxitPDFReader.exe", "FoxitReader.exe") and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "mshta.exe", "regsvr32.exe")

Splunk SPL Query

index=endpoint (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent, "%foxitpdfeditor.exe") OR like(parent, "%foxitpdfreader.exe") OR like(parent, "%foxitreader.exe"))
    AND (like(child, "%cmd.exe") OR like(child, "%powershell.exe") OR like(child, "%wscript.exe") OR like(child, "%cscript.exe") OR like(child, "%rundll32.exe") OR like(child, "%mshta.exe"))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines by host, parent, child
| sort - count

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91793,">
  <rule id="100917" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)Foxit(PDFEditor|PDFReader|Reader)\.exe$</field>
    <field name="win.eventdata.image">(?i)(cmd|powershell|wscript|cscript|rundll32|mshta)\.exe$</field>
    <description>CVE-2026-91793: Possible Foxit PDF use-after-free exploitation - Foxit spawned suspicious child process $(win.eventdata.image)</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>foxit,pdf,uaf,exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no workaround, and no affected version range are available from the data provided. The guidance below is therefore precautionary.

1) Immediate mitigations.

• Treat all PDF files from external or untrusted sources as potentially hostile. Enforce attachment sandboxing and detonation for inbound PDFs before user delivery.
• Consider opening untrusted PDFs only in a hardened viewer or in an isolated environment (virtual machine, containerized viewer, or application sandbox) rather than in the default desktop Foxit installation.
• Disable or restrict embedded JavaScript execution in Foxit PDF Editor/Reader where the product permits it, as the trigger path described in the NVD entry involves script execution. Validate this against your deployed product configuration, since the exact setting is not specified in the available data.
• Monitor for Foxit process crashes; repeated crashes on specific documents are a strong signal of a malformed-file trigger and should be triaged as potential exploitation.
• Apply email and web gateway controls to quarantine PDFs that combine embedded JavaScript with embedded font data and annotation dictionaries.

2) Patch/upgrade steps.

• No patch exists per tracked sources. Monitor the Foxit security advisories page and the NVD entry for CVE-2026-91793 for the release of a fixed version.
• When a fix is published, inventory all endpoints and servers running Foxit PDF Editor/Reader, prioritize internet-facing and document-processing systems, and deploy the updated build through standard endpoint management.
• Because no affected version range is currently published, plan to treat all installed versions as affected until the vendor advisory narrows the scope.

3) Long-term hardening.

• Maintain a software bill of materials (SBOM) for endpoint applications, especially thick-client document viewers, so future advisories can be rapidly scoped.
• Adopt a least-privilege posture for document-processing users and restrict outbound network access to reduce post-exploitation impact if code execution is achieved.
• Implement application allow-listing and exploit-protection features (e.g., OS-level mitigation policies) on endpoints that open untrusted documents.
• Subscribe to vendor security notifications and track CISA KEV for this CVE; if it is added to KEV, elevate remediation priority immediately.

References

• NVD — CVE-2026-91793: https://nvd.nist.gov/vuln/detail/CVE-2026-91793
• CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• Foxit Security Advisories (vendor advisory pending for this CVE): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91793 not currently listed — verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91793 in the available data. No public PoC, exploit code, or Nuclei template exists at the time of writing. EPSS has not yet issued a score for this CVE; no EPSS value should be assumed.