CVE-2026-91802

Executive Summary

CVE-2026-91802 is a heap-based out-of-bounds write vulnerability (CWE-787) in Foxit PDF Editor and Foxit Reader, occurring within the WebP image decoding routine. The flaw stems from improper handling of bitmap stride and target buffer formats, allowing a crafted WebP asset to write beyond the bounds of a heap-allocated buffer. Successful exploitation requires user interaction to open a malicious document, but achieves high confidentiality, integrity, and availability impact on the affected host (CVSS 7.8). No public PoC, exploit code, Nuclei template, or vendor patch is currently available.

Technical Analysis

The vulnerability is classified as a heap-based out-of-bounds write (CWE-787) and resides specifically in the WebP image decoding path of Foxit PDF Editor and Foxit Reader. The root cause, as described, is "improper handling of bitmap stride and target buffer formats."

To understand the mechanism at the class level: raster image decoders process pixel data line by line. Each line of an image is padded to align with memory boundaries, and the amount of memory occupied by a single line — including padding — is referred to as the "stride" (or pitch). The decoder computes this stride during image setup and then, during decoding, writes pixel data into a destination buffer based on the computed stride and the assumed target buffer format. If the stride calculation and the target buffer format disagree — for example, if the decoder assumes an output format with a different channel count or byte-per-pixel layout than the buffer actually uses — the write offset for a given row can exceed the allocated buffer region. This results in a heap out-of-bounds write.

The relevant attack surface is any code path through which Foxit PDF Editor or Foxit Reader decodes an embedded or referenced WebP image. PDF documents can embed images as XObjects, and modern Foxit builds render such embedded assets during normal document viewing. Because WebP support is integrated into the rendering pipeline, the decoder is reachable simply by opening a document — no macro execution or scripting is required at the vulnerability level.

The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates the attack is delivered via a local vector requiring user interaction — consistent with a user opening a malicious file. The impact subscores (C:H/I:H/A:H) reflect that a successful heap out-of-bounds write of this class can potentially be leveraged beyond a simple crash, though the NVD description explicitly states the immediate consequence is an application crash.

Critically, the description notes that "successful exploitation could result in an application crash." This is an important scoping statement: the observable, documented outcome is a denial-of-service condition (crash). The vulnerability class — heap out-of-bounds write — is broadly associated with potential memory-corruption exploitation, but the specific data provided does not confirm arbitrary code execution. Any discussion of code execution beyond the documented crash must be treated as theoretical and tied to the general properties of CWE-787, not to confirmed behavior of this CVE.

No specific function names, buffer names, file paths, or API endpoints are provided in the available intelligence. As a result, this report deliberately avoids naming internal decoder routines, as doing so would require fabrication and is not supported by the source data.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-91802, and no exploit code has been observed. The following attack chain is inferred strictly from the vulnerability class and the NVD description; it does not rely on fabricated implementation details.

1. Reconnaissance / target identification. An attacker identifies targets likely running Foxit PDF Editor or Foxit Reader — for example, organizations that standardize on Foxit for PDF handling, or individual users known to use it. Because the vector is local with user interaction, the attacker must deliver a file to the victim rather than exploit a remotely listening service. Reconnaissance therefore focuses on identifying victims who will open a PDF or image file rather than on network scanning.

2. How the specific flaw class is triggered. The attacker crafts a malicious asset containing a WebP image whose encoded parameters cause the decoder's stride/pitch computation to mismatch the actual target buffer layout. When Foxit processes this asset — by opening the PDF that embeds or references it — the decoder performs pixel writes using a stride greater than the allocated destination region, producing a heap out-of-bounds write. The specific crafting mechanism (exact WebP header fields, dimension values, or format flags) is not described in the available intelligence and must not be assumed. At the vulnerability-class level, the trigger is a mismatched stride/format calculation exercised by decoding attacker-controlled image data.

3. Payload / execution method. The payload is a document (for example, a PDF) that embeds the malformed WebP asset. Delivery occurs through standard phishing or file-sharing channels. The user must open the document (UI:R) for the decoder to run. No credentials or special privileges are required on the victim side (PR:N), but the trigger depends entirely on user interaction. No specific script, macro, or code execution primitive is documented for this CVE; the documented outcome is a crash.

4. Post-exploitation impact. The confirmed consequence per the description is an application crash — an availability impact on the Foxit process. Because a heap out-of-bounds write is a memory-corruption class, an attacker who can reliably control the written data and surrounding heap layout could theoretically pursue further memory corruption; however, this is not confirmed by the provided data and remains a theoretical extension of the vulnerability class. Any code-execution scenario should be validated independently and is not asserted here.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

CVE-2026-91802 carries a CVSS 3.1 base score of 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack Vector (AV:L). The vulnerability is delivered locally, consistent with a file-open scenario rather than a network service. The practical delivery mechanism is a malicious document, but the attack interface itself is local.
• Attack Complexity (AC:L). No unusual conditions are described as prerequisites; the decoder is triggered through normal document processing.
• Privileges Required (PR:N). The attacker does not need authentication or prior access on the target to reach the vulnerable decoder via a delivered file.
• User Interaction (UI:R). A user must open the crafted asset/document for exploitation to occur. This reduces the attack's automation but is trivially achievable via phishing.
• Scope (S:U). The impact is confined to the vulnerable Foxit process and its security context.
• Confidentiality / Integrity / Availability (C:H/I:H/A:H). All three dimensions are scored High, reflecting the memory-corruption class and its theoretical potential, while the documented observable effect is an application crash.

Business impact. Organizations where Foxit PDF Editor/Reader is a standard PDF tool face a client-side attack surface that is difficult to eliminate because opening PDFs is routine business activity. The most reliable immediate impact is denial-of-service — a crashed PDF reader disrupts a user's workflow and, if the crash is repeatable, can render an endpoint unable to view documents until the file is removed. Because the underlying class is a heap out-of-bounds write, security teams should treat the potential for more severe memory corruption as a risk to be validated rather than dismissed, while recognizing that only a crash is confirmed by available data.

Blast radius. The blast radius per incident is a single user endpoint and that user's privileges — not a server or shared service. There is no evidence of lateral, worm-like, or pre-authentication remote behavior. However, a successful client-side memory-corruption exploit in a privileged user's PDF reader could, in a worst-case theoretical extension, operate with that user's privileges. At scale, an attacker distributing a malformed document to many users could generate widespread crashes across an organization.

No affected version range is available from tracked sources, which complicates precise scoping. Until the vendor clarifies affected builds, all deployed Foxit PDF Editor/Reader instances should be considered potentially exposed.

Detection Guidance

Because this is a client-side file-format vulnerability with no public exploit artifacts, detection strategy focuses on (a) host-side process crash telemetry, (b) anomalous memory behavior in the Foxit process, and (c) network/file indicators of malformed WebP assets. The rules below are behavior- and class-oriented and are intended as detection starting points, not as signatures for a confirmed exploit.

Sigma Rule

title: Foxit PDF Reader/Editor Crash from Malformed WebP Decoding (CVE-2026-91802)
id: 3f9c1a72-0b6e-4d2a-9c1e-2026cve91802
status: experimental
description: Detects repeated Foxit PDF Editor/Reader process crashes potentially caused by malformed WebP image decoding leading to a heap out-of-bounds write (CVE-2026-91802).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91802
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.t1203
  - cve.2026-91802
logsource:
  product: windows
  service: application
detection:
  selection_product:
    Provider:
      - 'Application Error'
      - 'Windows Error Reporting'
  selection_image:
    Message|contains:
      - 'FoxitPDFEditor.exe'
      - 'FoxitPDFReader.exe'
      - 'Foxit Reader'
      - 'FoxitPDFReader'
  selection_fault:
    Message|contains:
      - 'Faulting module'
      - 'APPCRASH'
  condition: selection_product and selection_image and selection_fault
falsepositives:
  - Legitimate Foxit crashes unrelated to WebP decoding
  - Out-of-memory conditions on low-resource endpoints
level: medium

YARA Rule

rule CVE_2026_91802_Foxit_WebP_Embedded
{
    meta:
        description = "Detects PDF documents embedding WebP image data for triage of potential CVE-2026-91802 exploitation"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91802"
        severity = "medium"

    strings:
        $pdf_magic = "%PDF-"
        $webp_riff = "RIFF"
        $webp_tag = "WEBP"
        $webp_vp8  = "VP8 "

    condition:
        $pdf_magic at 0 and
        $webp_riff and $webp_tag and $webp_vp8
}

Note: The YARA rule above is heuristic. It flags PDF documents that embed WebP content, which is the delivery vehicle class for this vulnerability. It does not detect the specific stride/format mismatch, since no byte-level pattern for that mismatch is available.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91802 Possible Foxit WebP Malformed Image Exfiltration or Retrieval"; flow:to_server,established; content:"RIFF"; offset:0; depth:4; content:"WEBP"; distance:4; within:4; classtype:attempted-user; sid:202691802; rev:1; metadata:cve CVE-2026-91802, affected_product Foxit_PDF_Editor, affected_product Foxit_Reader;)

Note: This rule detects WebP content traversing the network (for example, a document embedding a WebP that is fetched or transmitted) and is intended for situational awareness. It is not a reliable exploitation signature, because the malformed-stride condition is not observable at the network layer without deeper parsing.

Elastic Detection

sequence by host.name
  [process where event.type == "start" and process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe")]
  [process where event.type == "end" and process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe") and process.exit_code != 0]

Note: This EQL sequence correlates a Foxit process start with a non-zero exit, approximating a crash. Tune exit_code and add winlog/WER event joins where available for higher fidelity.

Splunk SPL Query

index=wineventlog (source="WinEventLog:Application" OR source="WinEventLog:Windows Error Reporting")
(Message="*FoxitPDFReader*" OR Message="*FoxitPDFEditor*" OR Message="*Foxit Reader*")
(Message="*Faulting module*" OR Message="*APPCRASH*" OR Message="*Access violation*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, Message
| where count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Note: Repeated crashes of the Foxit process across a host are a useful lead. Correlation with a recently opened document (via file-access or Sysmon FileCreate telemetry) helps distinguish malicious from incidental crashes.

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91802,">
  <rule id="100918" level="8">
    <decoded_as>json</decoded_as>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.message">\.exe</field>
    <match>FoxitPDFReader|FoxitPDFEditor|Foxit Reader</match>
    <description>CVE-2026-91802: Foxit PDF Reader/Editor crash possibly caused by malformed WebP image decoding (heap out-of-bounds write).</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Note: Designed for Windows Event Channel ingestion (Application Error / WER). Adjust field paths to match your Wazuh Windows event decoder schema.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No patch evidence exists from any tracked source, no vendor fix is documented, and no affected version range has been published. The following recommendations are based on the vulnerability class and current status.

1) Immediate mitigations

• Treat untrusted PDFs and image files as high-risk. Restrict automatic opening of PDFs from email, web downloads, and file shares where policy allows.
• Where operationally feasible, disable or restrict WebP rendering if the Foxit build exposes a configuration toggle; verify current configuration options in the product documentation rather than assuming a toggle exists.
• Enforce least privilege on endpoints so that any memory-corruption impact is contained to a non-administrative user context. Do not run Foxit with elevated rights.
• Deploy the detection rules above and monitor for repeated Foxit process crashes, especially clustered around a specific document or sender.
• Consider a temporary alternative PDF viewer for high-risk document ingestion workflows until a vendor fix is issued.

2) Patch / upgrade steps

• No patch or fixed version is currently identified. Monitor the Foxit security advisory page and the NVD record for CVE-2026-91802 for vendor confirmation and fixed build numbers.
• Once a fixed version is published, prioritize upgrading all Foxit PDF Editor/Reader installations, including those under managed update channels. Validate that the fixed build is actually deployed, as many endpoints run stale builds.
• If the vendor publishes an advisory with specific affected version ranges, use it to scope exposure accurately; currently no such range is available.

3) Long-term hardening

• Maintain an inventory of client-side document viewers and their versions. Out-of-date PDF readers are a recurring exploitation vector.
• Apply application allow-listing and exploit-protection features (for example, Windows Defender Exploit Guard / arbitrary code guard, heap protections) to reduce the exploitability of heap-corruption classes.
• Filter and sandbox inbound documents; render untrusted files in a containerized or cloud-based preview if available.
• Establish a routine patch cadence for document-handling software and subscribe to vendor security advisories and CISA alerts.
• Educate users on phishing and malicious document delivery, since UI:R means user action is the final enabler.

References

• NVD — CVE-2026-91802: https://nvd.nist.gov/vuln/detail/CVE-2026-91802
• CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK — T1203 Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• FIRST EPSS — not yet scored for this CVE (no value available at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-91802 is not listed as of this report; confirm current status at https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: No public PoC, no exploit code, and no Nuclei template were identified for CVE-2026-91802 at the time of writing. No threat actor campaign has been attributed. This report contains no evidence of active exploitation; all exploitation content is inferred from the vulnerability class and the NVD description.