CVE-2026-91807

Executive Summary

CVE-2026-91807 is a heap-based out-of-bounds read vulnerability (CWE-125) in Foxit PDF Editor and Foxit PDF Reader, occurring during the parsing of malformed image soft-mask data. Insufficient validation of a soft-mask data attribute can cause an arithmetic underflow, which then drives an out-of-bounds memory read, resulting in an application crash. The CVSS 3.1 score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) indicates a locally exploitable, user-interaction-driven flaw whose primary demonstrated impact is a high-availability loss (application crash) with limited confidentiality impact, making it most relevant to endpoint resilience, document-handling pipelines, and file-submission/scanning services rather than a direct remote code-execution risk.

Technical Analysis

Vulnerability class. CVE-2026-91807 is a heap-based out-of-bounds read, classified under CWE-125 (Out-of-bounds Read). The flaw resides in the component of Foxit PDF Editor/Reader responsible for handling image soft-mask data during PDF image parsing. Soft masks (the /SMask construct in PDF image XObjects) are auxiliary image streams that define per-pixel transparency for the image they accompany. A malformed soft-mask attribute is not validated sufficiently before it is consumed by an arithmetic computation, resulting in an integer/arithmetic underflow.

Mechanism. Per the NVD description, the sequence is:

1. A PDF containing a malformed image soft-mask data attribute is parsed.
2. The soft-mask attribute is insufficiently validated.
3. An arithmetic underflow occurs (a computation yields a value below the intended lower bound, e.g., wrapping to a very large unsigned value or a negative offset).
4. The underflowed value is used as a length, offset, or index into a heap buffer.
5. This results in an out-of-bounds read against heap memory.
6. The out-of-bounds read causes an application crash.

The NVD description explicitly attributes the crash to the out-of-bounds read. It does not state that the out-of-bounds data is disclosed to an attacker, leaked across a trust boundary, or used for control-flow hijack. The limited confidentiality subscore (C:L) reflects that an out-of-bounds read can in principle expose adjacent heap memory, but no demonstrated information-disclosure primitive is claimed in the available intelligence.

Attack surface. The attack surface is file/document parsing: any workflow in which a user or automated service opens a PDF with Foxit PDF Editor or Foxit PDF Reader. Because the primitive is triggered by parsing crafted soft-mask image data, delivery is via a malicious PDF document. No network-listening service, exposed API endpoint, or remote pre-authentication vector is described.

Sparse-data caveat. The available intelligence does not disclose specific function names, class names, file paths, parser entry points, or the exact arithmetic operation involved. This report deliberately does not invent those details. The mechanism is described strictly at the level supported by the NVD description: insufficient validation of soft-mask data → arithmetic underflow → out-of-bounds read → crash.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-91807. The attack chain below is therefore inferred from the vulnerability class and the NVD description, not from observed exploit artifacts.

1) Reconnaissance / target identification. An adversary identifies hosts running Foxit PDF Editor or Foxit PDF Reader. Because the flaw is local and requires user interaction, the objective is to deliver a crafted PDF to a target that will open it in Foxit. This is a classic client-side, document-borne attack pattern; the "reconnaissance" step is simply identifying that Foxit is the default or installed PDF handler on the intended victim endpoint.

2) Trigger of the specific flaw class. The attacker crafts a PDF containing an image object whose soft-mask data attribute is malformed — constructed so that the insufficient validation path is reached and the arithmetic underflow is produced. The exact malformation is not specified in available intelligence; it is an input condition in the soft-mask data attribute of an image, not a network payload.

3) Delivery/execution method at the vulnerability-class level. The crafted PDF is delivered to the target (email attachment, web download, shared drive, or a document-submission pipeline) and must be opened by the victim (UI:R). On parsing, Foxit's soft-mask handling consumes the malformed attribute, the underflow occurs, and an out-of-bounds heap read follows, crashing the application. Because the CVSS vector is AV:L and PR:N, no authentication or privileges are needed — only the act of opening the file on the local system.

4) Post-exploitation impact. The described and demonstrated impact is denial of service via application crash (A:H). The read is out-of-bounds and could theoretically expose adjacent heap contents (C:L), but no data-exfiltration primitive is documented. There is no evidence in the provided intelligence of code execution, privilege escalation, or persistence. In a crash-only exploit, the practical "post-exploitation" objective is disruption — e.g., repeated crashing of a user's editor, or halting an automated PDF-processing/scanning service that relies on Foxit.

No threat-actor attribution, campaign, or in-the-wild exploitation evidence is available for this CVE.

Impact Assessment

CVSS 3.1 subscores (score 6.1):

• AV:L (Local): Exploitation requires local interaction with the vulnerable application (opening a file on the host), not a remotely reachable service.
• AC:L (Low): No special conditions beyond processing the crafted input; the attack is repeatable.
• PR:N (None): No privileges required.
• UI:R (Required): A user must open the crafted PDF.
• S:U (Unchanged): The impact stays within the vulnerable component's security scope.
• C:L (Low): An out-of-bounds read may expose limited adjacent memory.
• I:N (None): No integrity impact is described.
• A:H (High): The out-of-bounds read results in an application crash — complete loss of availability for the affected process.

Business impact. The principal business risk is availability/disruption, not data breach. Relevant exposure areas include:

• End-user endpoints: Repeatedly crashing the PDF editor degrades productivity and can be used as a nuisance/DoS vector in targeted social-engineering campaigns.
• Automated document pipelines: Any service that programmatically opens untrusted PDFs with Foxit (e.g., invoice processing, mail-gateway attachment rendering, threat-scanning sandboxes) is at risk of crash-induced service disruption when fed a malformed soft-mask image.
• Blast radius: Bounded to the Foxit process and the host that opens the file. There is no multi-host propagation, no worm behavior, and no demonstrated lateral movement. Because it is unpatched (0/4) and user-interaction dependent (UI:R), the risk is persistent but contained to document-opening workflows.

Priority note. With no KEV listing, no public exploit, and a primary impact of DoS, this is a moderate-priority item for most enterprises — but a higher-priority item for organizations that rely heavily on Foxit for automated processing of untrusted PDFs.

Detection Guidance

Detection for this CVE is primarily host- and file-centric, since the exploit is a crafted PDF rather than a network-protocol attack. The rules below focus on (a) Foxit process crashes indicative of malformed image parsing, and (b) anomalous PDF structures consistent with malformed soft-mask data. Beneath each rule, tune the process names/versions to your environment; the exact Foxit binary names and version strings are not available in the provided intelligence and should be populated from your software inventory.

Sigma Rule

title: Potential Foxit PDF Editor/Reader Crash from Malformed Soft-Mask Image Data (CVE-2026-91807)
id: 5f2a9c7e-1b4d-4e6a-9c3f-0a7e91807001
status: experimental
description: Detects the Foxit PDF Editor/Reader application faulting or terminating shortly after processing a PDF, consistent with an out-of-bounds read triggered by malformed image soft-mask data (CVE-2026-91807).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91807
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1204
  - attack.t1499
logsource:
  product: windows
  service: application
detection:
  selection_app:
    Provider_Name: 'Application Error'
    Message|contains:
      - 'FoxitPDFReader'
      - 'FoxitPDFEditor'
      - 'FoxitPDFReader.exe'
      - 'FoxitPDFEditor.exe'
  selection_fault:
    EventID:
      - 1000
      - 1001
    Message|contains:
      - 'Exception code: 0xc0000005'
  condition: selection_app and selection_fault
falsepositives:
  - Legitimate Foxit crashes unrelated to malicious PDFs
  - Other Foxit bugs producing access violations
level: medium

YARA Rule

rule PDF_Malformed_Image_SoftMask_CVE_2026_91807
{
    meta:
        description = "Detects PDFs containing image XObjects with anomalously formed soft-mask (SMask) references, consistent with the malformed soft-mask data described in CVE-2026-91807"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91807"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pdf_header = "%PDF-"
        $smask      = "/SMask"
        $imgsubtype = "/Subtype /Image"
        $imgsubtype_nospace = "/Subtype/Image"
        $stream     = "stream"
        $endstream  = "endstream"

    condition:
        $pdf_header at 0 and
        filesize < 50MB and
        ($smask and ($imgsubtype or $imgsubtype_nospace)) and
        $stream and $endstream
}

Note: The YARA rule above is intentionally conservative. Because the precise malformation of the soft-mask data attribute is not disclosed in available intelligence, the rule flags PDFs that combine an /SMask with an /Image subtype — a structural precondition for the vulnerable parsing path — rather than a byte-exact signature that cannot be reliably derived.

Suricata IDS Rule

Although this is not a network-service vulnerability, PDFs are frequently delivered over the network (email/HTTP). The following rule flags PDF downloads for backend content scanning; it is a delivery-stage heuristic, not a payload-exact signature.

alert http any any -> any any (msg:"FILE-PDF potential Foxit soft-mask image parsing issue (CVE-2026-91807) - PDF download"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/SMask"; content:"/Image"; distance:0; filestore; sid:202691807; rev:1; metadata:reference cve CVE-2026-91807; classtype:attempted-user;)

Elastic Detection

process where event.type == "start" and
  process.parent.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitPDFReader", "FoxitPDFEditor")

// Complementary: detect the Foxit process terminating unexpectedly after launching
process where event.action == "end" and
  process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe") and
  process.exit_code != 0

Splunk SPL Query

index=windows (source="WinEventLog:Application" OR source="XmlWinEventLog:Application")
(EventCode=1000 OR EventCode=1001)
(FoxitPDFReader OR FoxitPDFEditor OR FoxitPDFReader.exe OR FoxitPDFEditor.exe)
| stats count min(_time) as first_seen max(_time) as last_seen
    values(Message) as crash_details
    by host, EventCode
| where count >= 1
| sort - count

// Endpoint process-termination variant (requires Sysmon or EDR telemetry)
index=edr OR index=sysmon (EventCode=5 OR action=process_terminated)
(process_name="FoxitPDFReader.exe" OR process_name="FoxitPDFEditor.exe")
| stats count by host, process_name, user
| where count >= 3

Wazuh OSSEC Rule

<group name="foxit,cve_2026_91807,">
  <rule id="100918" level="6">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <match>FoxitPDFReader|FoxitPDFEditor|FoxitPDFReader.exe|FoxitPDFEditor.exe</match>
    <description>CVE-2026-91807: Foxit PDF application crash possibly triggered by malformed image soft-mask data</description>
    <mitre>
      <id>T1499</id>
      <id>T1204</id>
    </mitre>
    <group>foxit_crash,</group>
  </rule>

  <rule id="100919" level="4">
    <if_sid>100918</if_sid>
    <match>0xc0000005</match>
    <description>CVE-2026-91807: Foxit PDF application access violation (possible out-of-bounds read)</description>
    <group>foxit_crash,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix or advisory is available in the provided intelligence, and no affected-version range has been published. No workaround has been identified by tracked sources either. Treat this CVE as unpatched until Foxit publishes an advisory and fix.

1) Immediate mitigations (interim, defense-in-depth):

• Restrict exposure: Avoid opening untrusted or unsolicited PDFs in Foxit PDF Editor/Reader until a fix is available. For high-risk users, temporarily designate an alternative, hardened PDF viewer for untrusted documents.
• Enforce sandboxing: Ensure Foxit's sandboxing/protected-mode capabilities are enabled, so a crashing or misbehaving renderer does not affect the host. Enable OS-level mitigations (e.g., Windows exploit protection / mitigations) for the Foxit binaries.
• Gate inbound documents: Subject all inbound PDFs to mail-gateway and file-sandbox content inspection and detonation before they reach an endpoint. Given the flaw is triggered by malformed soft-mask image data, sandboxes that render PDFs with Foxit can serve as a canary — but be aware they may crash, which is itself a detection signal.
• Lesson the automation risk: For automated pipelines that open untrusted PDFs with Foxit, isolate the job in a disposable, non-privileged container/VM and implement supervisor-based restart/alerting so a crash surfaces as a monitored event rather than a silent outage.
• Monitor vendor channels: Watch Foxit's security advisory page and the NVD entry for the first patch release; apply it as soon as it is published.

2) Patch / upgrade steps:

• No patch is currently available. When Foxit releases a fixed build, upgrade both Foxit PDF Editor and Foxit PDF Reader (the description names both products) to the patched version.
• Do not rely on a specific target version — none is published. Track the vendor advisory for the exact "fixed in" version and validate against it in a test group before broad rollout.
• Since no affected-version range is published, assume all widely deployed versions are potentially affected and prioritize the update on hosts and services that routinely process untrusted PDFs.

3) Long-term hardening:

• Maintain an SBOM/software inventory of PDF-handling software, including the specific Foxit editions and versions deployed, so future version-range advisories can be actioned quickly.
• Adopt a default-hardened document workflow: treat all externally sourced PDFs as untrusted, render them only in sandboxed viewers, and avoid opening documents directly from email or browsers.
• Instrument crash telemetry: Forward application crash events for Foxit into the SIEM so CVE-related crashes (and any future in-the-wild exploitation producing crashes) are visible and alertable.
• Reduce attack surface: Remove untrusted-file associations for high-risk viewers where policy permits, and ensure least privilege for any service account that processes documents.
• Track this CVE to closure: Given zero patch confidence and no workaround, re-check the NVD entry and the Foxit advisory feed regularly and re-score the risk once exploitation evidence or a fix appears.

References

• NVD — CVE-2026-91807: https://nvd.nist.gov/vuln/detail/CVE-2026-91807
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• First.org EPSS (not yet scored for this CVE at time of publication): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91807 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Foxit Security Advisories (check for the vendor advisory and fixed version once published): https://www.foxit.com/support/security-bulletins.html

No known threat-actor campaigns, in-the-wild exploitation evidence, public PoC, or Nuclei template were identified for CVE-2026-91807 in the available intelligence.