CVE-2026-91805

Executive Summary

CVE-2026-91805 is a use-after-free vulnerability (CWE-416) in Foxit PDF Editor and Foxit PDF Reader affecting the application's PDF page-tree handling logic. An attacker can craft a malicious PDF document that manipulates the page structure during the rendering process, causing the application to access page objects that have already been released from memory. Successful exploitation results in memory corruption and an application crash, with a CVSS v3.1 base score of 7.8 (High). At the time of this report, no public proof-of-concept, exploit code, Nuclei template, or vendor patch exists, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in the page-tree handling subsystem of Foxit PDF Editor and Foxit PDF Reader. In accordance with the PDF specification, a PDF document organizes pages into a hierarchical structure known as the page tree. Foxit's rendering engine traverses this tree to build the in-memory representation of the document and draw its pages. CVE-2026-91805 is classified as CWE-416 (Use After Free), which means that a memory region allocated to a page object is freed while a reference to it remains live, and that dangling reference is subsequently dereferenced.

Per the NVD description, the trigger condition is a "page-structure change during rendering." This indicates a temporal inconsistency: while the application is rendering a document, a specially crafted PDF causes the page structure to be mutated in a way that invalidates already-released page objects. The renderer then accesses these released page objects, producing memory corruption. Because page objects and their subordinate structures are heap-allocated, reuse of the freed region can place attacker-influenced data in the location the renderer later treats as a page object, which is the classic pathway from use-after-free to controllable memory corruption.

The attack surface is the PDF parsing and rendering pipeline. Foxit Reader and Editor are widely deployed as standalone desktop PDF clients and are also embedded in browsers and enterprise document workflows via plug-ins and integrations. Because the flaw is reachable by opening a document, the primary delivery vector is a malicious PDF file that a victim opens locally.

The CVSS v3.1 vector is AV:L (Local) / AC:L (Low) / PR:N (None) / UI:R (Required) / S:U (Unchanged) / C:H / I:H / A:H. The Local attack vector reflects the fact that exploitation requires the malicious file to be present on the victim's machine and opened in the vulnerable application. The Required user interaction reflects the need for the victim to open the crafted PDF. The High Confidentiality, Integrity, and Availability impacts are consistent with a memory-corruption primitive: availability is directly affected (the described crash), while confidentiality and integrity impact depends on whether the freed memory can be shaped for code execution or information disclosure. No specific function, class, method, or file path is identified in the available NVD description, so the precise code location within Foxit's page-tree implementation cannot be stated with confidence and is intentionally not fabricated here.

Important caveat: the provided intelligence contains no affected version list, no vendor advisory, and no patch reference. Any statement about specific vulnerable builds would be speculative and is therefore omitted.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-91805. The following attack chain is inferred strictly at the vulnerability-class level (use-after-free triggered by page-structure changes during rendering) and does not assume any undocumented implementation details.

1. Reconnaissance / target identification. The attacker identifies a target organization or individual known to use Foxit PDF Reader or Foxit PDF Editor. Because the flaw is exposed through document rendering rather than a network service, the attacker does not need to scan for a listening port; instead, the attacker profiles the victim through phishing lists, industry targeting, or public document-exchange relationships. The attacker may also review Foxit's security advisories and patch-release cadence to assess the likelihood that the target's install base is up to date.

2. Triggering the flaw. The attacker crafts a PDF that alters its page structure during rendering — for example, by pairing a page-tree layout with content or document-level operations that cause the renderer to release a page object and then continue to reference it. The precise document constructs are not disclosed in the available data, but the mechanism is: page-structure mutation during rendering → premature free of a page object → dangling reference → out-of-bounds or reused-heap access. The attacker delivers the PDF via email attachment, a download link, or a hosted document that the victim is socially engineered into opening.

3. Execution / payload method. When the victim opens the file in the vulnerable Foxit product, the rendering path reaches the page-tree handling code and dereferences the freed page object. Depending on memory layout and heap grooming, the freed region may be reallocated with data the attacker controls or influences. In the minimal case this produces a crash (denial of service). In a more advanced case, the corruption primitive can be developed into code execution under the privileges of the Foxit process. No exploit code is public, so the reliability and exploitability of a full code-execution chain cannot be confirmed from available sources.

4. Post-exploitation impact. Because Foxit typically runs in the user's context, successful code execution would yield the attacker the privileges of the logged-in user, enabling data theft (confidentiality), document or system modification (integrity), and process termination or host instability (availability). In the absence of a working exploit, the demonstrated and immediately available impact is application crash and denial of service.

Impact Assessment

The CVSS v3.1 base score is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack Vector (AV:L): The attacker must get a file onto the victim's system and have it opened locally; no remote network exposure of the parser is assumed.
• Attack Complexity (AC:L): No special conditions beyond crafting and delivering the document are indicated.
• Privileges Required (PR:N): No prior authentication is needed.
• User Interaction (UI:R): The victim must open the malicious PDF.
• Scope (S:U): Impact is confined to the vulnerable Foxit process and its security context.
• Confidentiality / Integrity / Availability (C:H/I:H/A:H): The memory-corruption primitive supports high impact once developed; the availability impact (crash) is directly described in the NVD entry.

Business impact: Foxit PDF Reader and Editor are common in enterprise endpoint fleets, particularly where organizations prefer non-Adobe PDF clients. A use-after-free reachable by document open is a favored class for spear-phishing because it requires only that a user double-click an attachment. Even without weaponized code execution, crash-driven DoS can disrupt document-centric workflows. Where the corruption primitive can be shaped, the blast radius extends to the confidentiality and integrity of data accessible to the user's session and, potentially, to the host. Because there is no KEV listing and no public exploit, current in-the-wild risk is assessed as lower than the score alone might suggest, but the unpatched status and the common deployment of Foxit make it a meaningful exposure.

Detection Guidance

Sigma Rule

title: Suspicious Foxit PDF Reader/Editor Crash Indicative of Use-After-Free (CVE-2026-91805)
id: 8f4c2e11-6a3d-4b9e-9f21-0c7d5a1e2026
status: experimental
description: Detects abnormal termination of Foxit PDF Reader/Editor processes, which may indicate exploitation of a use-after-free in page-tree handling (CVE-2026-91805).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91805
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  product: windows
  category: process_creation
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_crash:
    CommandLine|contains:
      - 'crash'
  condition: selection_image and selection_crash
falsepositives:
  - Legitimate crash reports and diagnostic invocations
level: medium

YARA Rule

rule EXPL_CVE_2026_91805_Foxit_PDF_PageTree_UAF
{
    meta:
        description = "Detects PDFs referencing Foxit page-tree structures with indicators of structure mutation; heuristic for CVE-2026-91805"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91805"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pdf_magic = "%PDF-"

    condition:
        $pdf_magic at 0 and filesize < 5MB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"FILE-PDF Foxit PDF page-tree use-after-free exploit attempt (CVE-2026-91805)"; flow:established,to_server; file_data; content:"%PDF-"; content:"/Pages"; nocase; content:"/Contents"; nocase; classtype:attempted-user; reference:cve,2026-91805; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91805; sid:202691805; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe")

Splunk SPL Query

index=endpoint (process_name="FoxitPDFReader.exe" OR process_name="FoxitPDFEditor.exe" OR process_name="FoxitReader.exe") (event_type="crash" OR "Application Error" OR exception_code="0xc0000005")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name
| where count > 0

Wazuh OSSEC Rule

<group name="windows,foxit,cve-2026-91805,">
  <rule id="2026918" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">FoxitPDFReader.exe|FoxitPDFEditor.exe|FoxitReader.exe</field>
    <description>CVE-2026-91805: Possible Foxit PDF Reader/Editor use-after-free crash triggered by malicious PDF</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list has been identified.

1. Immediate mitigations

• Treat all unsolicited PDF attachments and downloads as untrusted; block or sandbox PDF delivery at the email and web gateways.
• Enable Foxit Protected Mode / sandboxing and any available exploit-mitigation hardening in the product settings, where supported.
• Disable or restrict JavaScript execution inside PDF documents in Foxit preferences to reduce attacker-controlled document behavior.
• Deploy PDF files to a detonation sandbox before delivery to users where feasible.
• Enforce application allowlisting and least privilege so that a compromised Foxit process runs with minimal user rights.
• Monitor for Foxit process crashes as a potential indicator of attempted exploitation.

2. Patch/upgrade steps

• No patch is currently available. Subscribe to Foxit's security advisory and release channels and to the NVD entry for CVE-2026-91805.
• When a fixed build is released, inventory all endpoints running Foxit PDF Reader/Editor (including per-user and portable installs and embedded components), then update or remove affected versions.
• Verify the updated build is actually running after deployment, including in browser plug-in and enterprise document-management integrations.

3. Long-term hardening

• Maintain a rapid software-update pipeline for productivity and PDF clients; these are common phishing targets.
• Apply exploit mitigations (ASLR, DEP/CFG, heap hardening) at the OS level and ensure PDF clients run in sandboxed or low-privilege contexts.
• Conduct user awareness training focused on attachment-based phishing.
• Extend EDR/XDR coverage to client document-processing applications and alert on crash telemetry correlated with recently opened PDFs.

References

• NVD — CVE-2026-91805: https://nvd.nist.gov/vuln/detail/CVE-2026-91805
• CWE-416: Use After Free — https://cwe.mitre.org/data/definitions/416.html
• Foxit Security Advisories: https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/

Note on exploit-in-the-wild evidence: No public exploit, PoC, Nuclei template, or threat actor campaign associated with CVE-2026-91805 has been identified in the available data. NVD lists no affected version range, and the CVE has not been added to CISA KEV.