CVE-2026-91795

Executive Summary

CVE-2026-91795 is a high-severity memory corruption vulnerability in Foxit PDF Editor and Foxit Reader, specifically within the FileOpen plugin. The flaw results from inadequate validation of encryption metadata embedded in specially crafted PDF files, which can corrupt an internal pointer and trigger chained read and write access violations. Successful exploitation requires a user to open a malicious PDF, but can lead to arbitrary code execution in the context of the vulnerable application, with an assessed CVSS base score of 7.8 (High).

Technical Analysis

The vulnerability is classified under CWE-822 (Untrusted Pointer Dereference) and arises in the FileOpen plugin component that Foxit PDF Editor and Foxit Reader use to parse and decrypt protected PDF documents. According to the NVD description, the plugin "did not adequately validate certain encryption metadata in specially crafted PDF files." Encryption metadata in PDF structures governs how a document's streams and strings are decrypted — it includes elements such as encryption dictionaries and algorithm parameters that influence pointer and buffer handling during decryption. When this metadata is malformed or crafted, the application fails to validate it sufficiently.

The result is that an internal pointer is left in an invalid state. That invalid pointer is then dereferenced, producing "chained read and write access violations." A read access violation typically corresponds to an out-of-bounds read or access to memory the pointer no longer validly references, while a write access violation indicates the corrupted pointer is used as a destination for a write operation. The combination of both read and write primitives on attacker-influenced memory handling is what elevates this from a simple crash to a potential code-execution primitive — the attacker can potentially redirect execution or corrupt adjacent memory in a controlled manner.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates: local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and High confidentiality, integrity, and availability impact (C:H/I:H/A:H). The local vector reflects that the attack is delivered via a file opened on the target host rather than over a network service, and UI:R reflects that the victim must open the malicious document. The High impact ratings reflect that arbitrary code execution, if achieved, compromises confidentiality, integrity, and availability of the user's session.

No function names, class names, offsets, or specific code paths are disclosed in the available CVE data; the analysis above is derived solely from the description's reference to encryption metadata validation, invalid pointer state, and chained read/write access violations. The precise malformed metadata field and the exact dereference site are not publicly documented in the provided intelligence.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE, and no exploit-in-the-wild evidence is recorded. The attack chain below is therefore described at the vulnerability-class level, inferred from CWE-822 and the NVD description; it does not assume specific function names or code patterns.

1. Reconnaissance / target identification. An attacker identifies targets running Foxit PDF Editor or Foxit Reader with the FileOpen plugin. Because the vector is local (AV:L) and requires user interaction (UI:R), the attacker's objective is to deliver a PDF file to a victim and persuade them to open it. Reconnaissance focuses on identifying users or organizations that routinely open PDFs from external or untrusted sources.

2. Triggering the flaw. The attacker crafts a PDF containing malformed or specially constructed encryption metadata. When the victim opens the document in the affected Foxit product, the FileOpen plugin parses this metadata during the decryption workflow. Due to inadequate validation, an internal pointer is placed into an invalid state. Per the description, opening the file is the triggering action — no additional privileges or interaction beyond opening the document is required.

3. Payload / execution method. The invalid pointer is subsequently dereferenced, causing chained read and write access violations. At the vulnerability-class level, memory corruption of this kind can allow the attacker to influence memory contents via the write primitive and disclose or redirect memory via the read primitive. Depending on heap layout and protections (e.g., ASLR, DEP), this can be leveraged toward arbitrary code execution. No specific technique, offset, or gadget chain is documented in the available data, and none is asserted here.

4. Post-exploitation impact. If arbitrary code execution is achieved, the attacker operates in the context and privileges of the Foxit application and the logged-in user. CVSS rates confidentiality, integrity, and availability impacts as High, meaning data theft, document/system modification, and disruption are all plausible outcomes. Because the scope is unchanged (S:U), the impact is confined to the security authority of the vulnerable application rather than escalating to the whole system by default — though code running as the user can still pursue privilege escalation or lateral movement separately.

Defensive value in this section lies less in replicating an unproven exploit and more in recognizing the delivery pattern: a suspicious PDF that causes Foxit to crash or behave abnormally when opened is the most observable early symptom.

Impact Assessment

The CVSS base score of 7.8 (High) reflects high impact across all three CIA dimensions with a local vector and required user interaction. Business impact includes:

• Endpoint compromise: Successful exploitation yields code execution in the user's context, which can lead to credential theft, ransomware staging, or persistent access.
• Document-centric attack surface: PDF readers are ubiquitous in enterprise environments, and PDF delivery via email, web downloads, or shared drives is routine, making user-interaction requirements a weak barrier in practice.
• Blast radius: Affected systems are those with vulnerable Foxit PDF Editor or Reader installations that include the FileOpen plugin. Because no version range or patch data is available, it is not currently possible to enumerate precisely which builds are affected, which widens the uncertainty for defenders.
• Unpatched status: With Patch Confidence 0/4 and no vendor fix identified, every deployed instance must be treated as potentially exploitable until Foxit publishes remediation.
• No known exploitation: CISA KEV status is NO, EPSS is unscored, and no PoC exists. Current real-world risk is theoretical to opportunistic but should be monitored, as PDF-reader memory corruption vulnerabilities are frequently weaponized once technical details or patches become public (patch diffing accelerates exploit development).

Detection Guidance

Sigma Rule

title: Potential Foxit PDF FileOpen Plugin Exploitation via Crafted PDF
id: 7c3e1a92-4b6d-4f0e-9a21-1f2d5c8e9b34
status: experimental
description: Detects Foxit PDF Editor or Reader crashing or terminating abnormally when opening a PDF, which may indicate exploitation of CVE-2026-91795 (CWE-822 pointer dereference in FileOpen plugin encryption metadata handling).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91795
author: Threat Intelligence Team
date: 2026/01/01
tags:
  - attack.t1204.002
  - attack.execution
logsource:
  product: windows
  service: application
detection:
  selection_app:
    Provider_Name: 'Application Error'
    Message|contains:
      - 'FoxitPDFReader.exe'
      - 'FoxitPDFEditor.exe'
      - 'FoxitReader.exe'
  selection_fault:
    Message|contains:
      - 'c0000005'
      - 'Exception code'
  condition: selection_app and selection_fault
fields:
  - Message
  - Data
falsepositives:
  - Legitimate Foxit application crashes unrelated to exploitation
level: medium

YARA Rule

rule CVE_2026_91795_Foxit_FileOpen_Malformed_Encrypt_Metadata
{
    meta:
        description = "Detects PDF files containing malformed or suspicious encryption metadata that may target the Foxit FileOpen plugin pointer dereference flaw (CVE-2026-91795)"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91795"
        severity = "high"

    strings:
        $pdf_header = "%PDF-"
        $encrypt1 = "/Encrypt"
        $encrypt2 = "/EncryptMetadata"
        $cf = "/CF"
        $stmcf = "/StmF"
        $strcf = "/StrF"
        $crypt_filter = "/Crypt"
        $vfield = "/V "
        $length = "/Length"

    condition:
        $pdf_header at 0 and
        filesize < 20MB and
        $encrypt1 and
        2 of ($encrypt2, $cf, $stmcf, $strcf, $crypt_filter) and
        1 of ($vfield, $length)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91795 Potential Malicious PDF Delivery Targeting Foxit FileOpen Encryption Metadata"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/Encrypt"; nocase; content:"/EncryptMetadata"; nocase; content:"/CF"; nocase; content:"/Crypt"; nocase; filestore; sid:202691795; rev:1; metadata:reference nvd.nist.gov/vuln/detail/CVE-2026-91795, created_at 2026_01_01; classtype:attempted-user; priority:2;)

Elastic Detection

process where event.type == "start"
  and process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe")
  and process.parent.name : ("outlook.exe", "winword.exe", "chrome.exe", "firefox.exe", "msedge.exe", "explorer.exe")

Splunk SPL Query

index=windows source="XmlWinEventLog:Application" (Provider_Name="Application Error" OR Provider_Name="Windows Error Reporting")
| search Message IN ("*FoxitPDFReader.exe*", "*FoxitPDFEditor.exe*", "*FoxitReader.exe*")
| search Message IN ("*c0000005*", "*access violation*", "*Exception code*")
| stats count min(_time) as first_seen max(_time) as last_seen values(Message) as crash_detail by host, Provider_Name
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="windows,application_error,cve_2026_91795,">
  <rule id="202691" level="10">
    <if_sid>60002</if_sid>
    <field name="win.eventdata.providerName">Application Error|Windows Error Reporting</field>
    <field name="win.eventdata.param1">FoxitPDFReader.exe|FoxitPDFEditor.exe|FoxitReader.exe</field>
    <description>CVE-2026-91795: Foxit PDF application crashed with possible access violation - potential FileOpen plugin exploitation via crafted PDF</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>cve_2026_91795,pdf_exploit,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict the opening of PDF files from untrusted sources (email attachments, web downloads, removable media) until a vendor fix is available.
   • Enforce application allow-listing and consider disabling or removing the FileOpen plugin functionality if it is not operationally required, since the plugin is the affected component.
   • Leverage Enterprise/Document protection features such as Protected View / Protected Mode if available in deployed Foxit versions, to sandbox rendering of untrusted documents.
   • Apply attack surface reduction and exploit mitigation controls (ASLR, DEP, CFG) at the OS level; these are not fixes but raise the difficulty of converting memory corruption into code execution.
   • Monitor for and investigate Foxit crash reports and unexpected termination of FoxitPDFReader.exe / FoxitPDFEditor.exe on endpoints.

2. Patch/upgrade steps

   • No vendor advisory, fix version, or patch reference has been identified for CVE-2026-91795 at this time. Monitor the Foxit security advisory channels and the NVD entry for the publication of an official fix. Once a patched version is released, stage and deploy it across all endpoints and verify version state post-upgrade. Because no affected version range is provided, treat all installed builds as potentially vulnerable and re-verify against vendor guidance when it becomes available.

3. Long-term hardening

   • Maintain an inventory of PDF reader and editor installations and subscribe to vendor security advisories for rapid patch response.
   • Adopt a least-privilege model for users who routinely open external documents and segment high-value systems from general user endpoints.
   • Combine email and web content filtering to block or quarantine PDFs with suspicious or malformed encryption structures.
   • Retain and review endpoint crash telemetry as a leading indicator of PDF exploitation attempts, since memory corruption in readers frequently manifests first as abnormal process termination.

References

• NVD — CVE-2026-91795: https://nvd.nist.gov/vuln/detail/CVE-2026-91795
• MITRE CWE-822 — Untrusted Pointer Dereference: https://cwe.mitre.org/data/definitions/822.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• Foxit Security Advisories (monitor for vendor fix): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91795 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild activity have been reported or observed for CVE-2026-91795. There is no public PoC, no Nuclei template, and no recorded exploitation; the CVE is not listed in CISA KEV and has no EPSS score. All exploitation discussion in this report is inferred from the vulnerability class (CWE-822) and the NVD description and does not represent confirmed in-the-wild activity.