CVE-2026-91804

Executive Summary

CVE-2026-91804 is a heap-based out-of-bounds write (CWE-787) in Foxit PDF Editor and Foxit Reader that is triggered when the application parses and renders a Circle annotation containing a malformed Cloudy appearance stream inside a specially crafted PDF file. The flaw stems from insufficient validation of the appearance geometry, which permits memory corruption and, under the right conditions, application crashes and potentially attacker-controlled code execution in the context of the victim user. Because exploitation requires the user to open a malicious PDF, the attack surface is the local document-parsing and rendering pipeline, and any endpoint running an affected Foxit build that processes untrusted PDFs is at risk.

Technical Analysis

The vulnerability resides in Foxit's handling of annotation appearance streams (AP streams), specifically for the Circle annotation type when it carries a "Cloudy" appearance. In the PDF specification, an annotation's appearance is defined by an appearance stream — a content stream drawn within a form XObject bounding box. Complex or decorative appearance styles such as "Cloudy" require the renderer to synthesize curved, variable geometry from parameters supplied inside the PDF (for example, the appearance's bounding box, transformation matrix, and the annotation's own geometry such as its rectangle and border effect parameters). The renderer must compute bounding geometry and allocate buffers sized to the resulting curve/point data before drawing.

The CVE description attributes the root cause to insufficient validation of the appearance geometry. When a crafted PDF supplies malformed or inconsistent geometry for a Circle annotation with a Cloudy appearance, the value used to size a heap allocation and the value used to index or write into that buffer diverge. This mismatch produces a classic heap-based out-of-bounds write: the parser writes beyond the end of an allocated buffer. CWE-787 (Out-of-bounds Write) is the assigned weakness class, confirming a memory-safety defect rather than a logic or privilege error.

Key characteristics derivable from the available data:

• Class: Heap-based out-of-bounds write (CWE-787). Memory corruption follows, leading to crashes and, where the write is controllable, potential code execution.
• Attack vector: Local (AV:L) — the crafted PDF must be delivered to and opened on the target system. The vector is not network-exploitable in a server sense; the trigger is local rendering.
• User interaction: Required (UI:R). The victim must open the malicious document in Foxit PDF Editor or Foxit Reader.
• Privileges required: None (PR:N) from the attacker's perspective — no prior account or elevated privilege on the target is needed.
• Scope: Unchanged (S:U). Impact is confined to the vulnerable application process under the victim's security context.

The description does not disclose specific function names, method identifiers, offsets, or internal structures. Those implementation-level details are not available in the provided intelligence and are therefore not speculated here. The confidence that the defect is memory-corruption-based is high given the explicit CWE-787 classification and the explicit "heap-based out-of-bounds write" wording.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-91804, and the CVE is not listed in CISA KEV. The following chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies a target user or organization that uses Foxit PDF Editor or Foxit Reader to open untrusted PDFs — for example, finance, legal, or administrative staff who routinely open externally supplied documents. The attacker confirms the product family via document workflows, public job postings, or application metadata rather than through network scanning, since the trigger is local.

2. Crafting the malicious document. The attacker authors a PDF containing a Circle annotation whose Cloudy appearance stream carries deliberately malformed appearance geometry (inconsistent sizing versus geometric data). No specific parameter names are disclosed by the CVE, so the exact field manipulation is not documented publicly. The goal is to make the renderer allocate a heap buffer of one size and write rendering data past its boundary.

3. Trigger / execution method at the vulnerability-class level. The victim opens the crafted PDF. During rendering of the annotation, Foxit fails to validate the appearance geometry, performs an out-of-bounds heap write, and corrupts adjacent heap memory. At the vulnerability-class level, this is a memory-corruption primitive; depending on heap layout and write controllability, the outcome ranges from a deterministic crash (denial of service) to attacker-influenced memory corruption that could be leveraged toward code execution in the victim's user context.

4. Post-exploitation impact. If the out-of-bounds write is reliably controllable, an attacker could pivot from a crash to arbitrary code execution running with the privileges of the Foxit process (typically the logged-in user). From there, typical post-exploitation activities include deploying additional tooling, harvesting documents and credentials, and using the host as a foothold. Absent a controlled write, the outcome remains at minimum an application crash — a localized denial of service.

Because no exploit or public research is available, the realistic near-term risk is denial of service via crash. Code execution should be treated as plausible but unproven until further analysis surfaces.

Impact Assessment

CVSS 3.1 base score is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Subscore interpretation:

• Confidentiality (High): a successful memory-corruption outcome could allow reading of process memory and any documents or data accessible to the user.
• Integrity (High): attacker-influenced memory writes could corrupt data or enable execution of unauthorized code.
• Availability (High): at minimum, the application crashes, interrupting workflows and potentially causing loss of unsaved work.
• Attack Complexity (Low) / Privileges Required (None): the attacker needs no target-side privilege, but must convince the victim to open the document (UI:R) and must deliver a local file (AV:L). This combination keeps the practical score high while reflecting the user-interaction gate.

Business impact centers on document-centric organizations and any endpoint fleet running Foxit PDF Editor/Reader. Blast radius scales with deployment footprint and user behavior: users who routinely open PDFs from email, downloads, or shared drives are the primary exposure. There is no server-side component, so the blast radius is endpoint-scoped rather than network-wide.

Detection Guidance

Sigma Rule

title: Suspicious Foxit PDF Reader/Editor Crash or Memory Corruption Indicator
id: 4b1c9f2a-7d3e-4a8b-9c1f-2026cve91804
status: experimental
description: Detects Foxit PDF Reader/Editor processes terminating abnormally after opening a PDF, consistent with CVE-2026-91804 heap out-of-bounds write during Circle annotation rendering.
author: valtersit.com SOC
logsource:
  product: windows
  category: process_creation
detection:
  selection_process:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_fault:
    EventID: 1000
    Provider_Name: 'Application Error'
    Message|contains: 'Foxit'
  condition: selection_process or selection_fault
falsepositives:
  - Legitimate application crashes unrelated to malicious documents
level: medium
tags:
  - attack.t1203
  - cve.2026.91804

YARA Rule

rule CVE_2026_91804_Foxit_Cloudy_Circle_Annotation
{
    meta:
        description = "Detects PDF files referencing Circle annotations with Cloudy appearance streams potentially abusing CVE-2026-91804"
        author = "valtersit.com SOC"
        cve = "CVE-2026-91804"
        date = "2026-01-01"
    strings:
        $pdf = "%PDF-"
        $c1 = "/Circle"
        $c2 = "/Cloudy"
        $c3 = "/BE" nocase
        $c4 = "/AP" nocase
        $c5 = "/Rect"
    condition:
        $pdf at 0 and $c1 and $c2 and ($c3 or $c4 or $c5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91804 Potential Foxit Cloudy Circle Annotation PDF Download"; flow:established,to_client; file_data; content:"%PDF-"; content:"/Circle"; content:"/Cloudy"; within:8192; classtype:attempted-user; reference:cve,2026-91804; sid:202691804; rev:1;)

Elastic Detection

process where process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and event.action == "process-crashed"

Splunk SPL Query

index=windows (EventCode=1000 OR EventCode=1001)
| where match(Message, "(?i)foxit")
| eval verdict="Possible CVE-2026-91804 heap corruption crash"
| table _time host EventCode Message verdict
| sort - _time

Wazuh OSSEC Rule

<group name="cve-2026-91804,foxit,">
  <rule id="100804" level="10">
    <if_sid>60000</if_sid>
    <match>Foxit</match>
    <match>Faulting application|Application Error|exception code</match>
    <description>CVE-2026-91804: Possible heap out-of-bounds write crash in Foxit PDF Editor/Reader during annotation rendering</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or affected-version data is available from any tracked source. No CISA KEV listing exists.

1. Immediate mitigations. Treat all untrusted PDFs as potentially malicious until a fix is published. Disable automatic opening/preview of PDF attachments in mail clients and browsers. Route documents through a non-Foxit viewer or an isolated/containerized rendering service for high-risk users. Consider temporarily blocking Circle-annotation-bearing PDFs at the mail gateway where policy permits, and enable OS-level protections (DEP, ASLR, and where available, exploit protection / ACG) to raise the difficulty of converting a crash into execution. Maintain EDR alerting on Foxit process crashes as a tripwire.

2. Patch/upgrade steps. No patch currently exists. Monitor Foxit's official security advisories and the NVD entry for CVE-2026-91804. When a fixed build is released, validate the exact version range affected, test in a staging environment, and deploy to all endpoints running Foxit PDF Editor/Reader. Subscribe to Foxit's security bulletin channel for notification.

3. Long-term hardening. Standardize on a single patched PDF reader with a formal patch SLA. Enforce least privilege so users cannot run as administrators, limiting the impact of any code execution. Adopt document sandboxing/detonation for external PDFs. Instrument EDR to detect anomalous child processes spawned by PDF viewers (a classic post-exploitation indicator) and monitor for heap-corruption crashes across the fleet.

References

• NVD — CVE-2026-91804: https://nvd.nist.gov/vuln/detail/CVE-2026-91804
• MITRE CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91804 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2026-91804 at the time of writing; the CVE is not in CISA KEV and no public PoC or exploit code is available.