CVE-2026-91808

Executive Summary

CVE-2026-91808 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor and Foxit Reader, triggered when processing PDF image objects that carry inconsistent compression metadata. Insufficient validation during image decoding can produce an undersized buffer, leading to an out-of-bounds read during rendering and an application crash. The vulnerability requires local interaction (the victim must open a crafted PDF), yields limited confidentiality impact, and has a high availability impact due to the crash condition.

Technical Analysis

The flaw resides in the image-object decoding path of Foxit PDF Editor and Foxit Reader. Per the NVD description, the trigger condition is a PDF image object whose compression metadata is inconsistent — that is, the metadata describing the compression scheme or the parameters associated with the encoded image data does not agree with the actual or expected characteristics of that data. During decoding, the application performs insufficient validation of these metadata-derived values. As a result, buffer sizing calculations can be based on the corrupt or inconsistent metadata rather than the actual decoded content, producing an allocation that is smaller than what the decoder subsequently requires.

Once an undersized buffer is established, the decoder proceeds to read beyond the allocated region — a classic heap-based out-of-bounds read (CWE-125). The out-of-bounds read manifests during the rendering stage, where the parsed image object is consumed and displayed. The observable consequence documented is an application crash, consistent with the high availability impact reflected in the CVSS vector (A:H, Confidentiality Low, Integrity None).

Two characteristics shape the risk profile:

1. Memory-safety class: This is an out-of-bounds read, not a write. The described primary effect is a crash — a denial-of-service condition on the affected process. The CVSS confidentiality subscore of Low (C:L) indicates the read may expose adjacent heap memory, but the description does not characterize what data becomes readable or whether it is returned to an attacker-controlled channel. No specific decoder routine, function name, class name, or code path is identified in the available description, so the exact implementation location cannot be confirmed.
2. Trigger requires parsing attacker-supplied content: The vulnerability is reached through the normal rendering workflow for a PDF containing crafted image objects. There is no indication of a remote, unauthenticated vector; the CVSS vector is AV:L (Local) with UI:R (User Interaction Required), and a scope of Unchanged (S:U), meaning exploitation is confined to the vulnerable application's security context.

The description does not specify the underlying operating system versions, the precise PDF structure elements involved beyond "image objects with inconsistent compression metadata," or the build versions affected. Those details are not available and should not be assumed.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-91808. The attack chain below is inferred strictly from the vulnerability class (heap-based out-of-bounds read in image decoding) and the NVD description; no specific function names, endpoints, or parameter names are provided in the source data and none are invented here.

1. Reconnaissance / target identification. An adversary selects targets whose users open untrusted PDFs in Foxit PDF Editor or Foxit Reader — for example, document-heavy enterprise environments, legal/finance workflows, or users who routinely receive PDFs via email. The operator identifies hosts running the affected Foxit products.

2. Triggering the flaw class. The attacker crafts a PDF that contains an image object whose compression metadata is intentionally inconsistent with the decoder's expectations. Per the description, this metadata inconsistency is the root trigger. The crafted file is delivered to the victim, typically as an email attachment or a downloaded document. No specific file structure tokens, dictionary keys, or decoder arguments are named in the available intelligence.

3. Payload / execution method. Exploitation is passive from the attacker's perspective: the victim must open or preview the malicious PDF (UI:R). Upon rendering, the decoder processes the image object, derives an undersized buffer from the inconsistent metadata, and performs an out-of-bounds read during the rendering stage. No code execution technique is described — the confirmed effect is a crash.

4. Post-exploitation impact. In the scenario documented by NVD, the outcome is a denial-of-service condition against the Foxit application process, which can cause loss of unsaved work and repeated end-user disruption. The CVSS C:L subscore means there is a limited potential to read out-of-bounds heap content, but the description does not establish an exfiltration path. Because scope is Unchanged and integrity impact is None, there is no documented path to modifying data or fully compromising the host from this vulnerability alone. Chaining with a separate primitive would be necessary for broader compromise, and no such chain is evidenced.

Attackers may weaponize this as a low-noise disruption vector against document-processing workflows, or attempt to combine a reliably crashing malformed PDF with a memory-disclosure objective given the C:L rating — but the latter is speculative absent further analysis.

Impact Assessment

• Availability (High): The crash is the most reliably reproducible outcome, making this primarily a denial-of-service risk. Users who rely on Foxit for reading and editing document sets may experience process termination when opening a malicious file, with resulting loss of unsaved work.
• Confidentiality (Low): The out-of-bounds read can theoretically expose adjacent heap memory during rendering. The CVSS confidentiality subscore reflects limited exposure; no concrete disclosure channel is described.
• Integrity (None): The flaw is a read operation; the description provides no basis for memory corruption resulting in data modification.
• Scope (Unchanged): Impact remains within the vulnerable application's context; there is no described mechanism for crossing privilege or sandbox boundaries.
• Attack vector (Local, User Interaction Required): The adversary must get a file onto the target and persuade a user to open it. This is a file-format, client-side vulnerability, not a remotely reachable service flaw.

Blast radius: Any endpoint running the affected Foxit PDF Editor or Reader builds that processes untrusted PDFs. Because no affected version range is published in the available data, asset owners should treat all unpatched Foxit installs handling external documents as potentially exposed until the vendor clarifies affected builds. The absence of a vendor fix and the 0/4 patch confidence materially raise the residual risk.

Detection Guidance

Sigma Rule

title: Potential Foxit PDF Reader/Editor Exploitation Attempt via Crafted PDF Image Object
id: 8f1c2a94-3b7e-4d1a-9c62-5e0d7a1f6b21
status: experimental
description: Detects Foxit PDF Editor/Reader process crashes or abnormal termination during PDF rendering, consistent with CVE-2026-91808 heap out-of-bounds read on crafted image objects.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91808
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_crash:
    EventID: 1000
    Application|contains: 'Foxit'
    FaultingModule|contains: 'Foxit'
  condition: selection_parent or selection_crash
fields:
  - Image
  - ParentImage
  - CommandLine
  - FaultingModule
  - ExceptionCode
falsepositives:
  - Benign crashes unrelated to exploitation
  - Legitimate malformed PDFs handled gracefully
level: medium
tags:
  - attack.t1204.002
  - cve.2026.91808

YARA Rule

rule CVE_2026_91808_Foxit_PDF_Inconsistent_Image_Metadata
{
    meta:
        description = "Heuristic detection of PDFs with suspicious/inconsistent image compression metadata consistent with CVE-2026-91808 trigger class (Foxit out-of-bounds read)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91808"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pdf_header = { 25 50 44 46 2D }
        $obj        = "%PDF"
        $img        = "/Image"
        $xobj       = "/XObject"
        $subtype    = "/Subtype"
        $filter     = "/Filter"
        $flatedec   = "/FlateDecode"
        $dctdec     = "/DCTDecode"
        $lzwdec     = "/LZWDecode"
        $stream     = "stream"

    condition:
        $pdf_header at 0 and
        filesize < 20MB and
        $img and
        $xobj and
        $subtype and
        $filter and
        ($flatedec or $dctdec or $lzwdec) and
        #stream > 2
}

Note: This YARA rule is a heuristic hunting aid for PDF image objects carrying compression filters — the vulnerability class itself is not reliably detectable through static file signatures alone; dynamic crash telemetry is a stronger signal.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91808 Foxit PDF image object exfil/telemetry of crafted document retrieval"; flow:to_server,established; content:"%PDF-"; depth:5; content:"/Image"; content:"/Filter"; sid:202691808; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_91808, signature_severity Informational; classtype:policy-violation;)

Note: CVE-2026-91808 is a local, file-format vulnerability. Network signatures cannot detect the crash itself. The rule above only flags PDF retrieval of documents containing image-object filter constructs and should be treated as low-fidelity context, not exploitation detection.

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where process.name : ("FoxitPDFReader.exe","FoxitPDFEditor.exe","FoxitReader.exe") and event.action == "start"]
  [process where process.name : ("FoxitPDFReader.exe","FoxitPDFEditor.exe","FoxitReader.exe") and event.action in ("end","stop") and process.exit_code != 0]

Detects Foxit processes that terminate abnormally shortly after launch, an indicator consistent with crash-on-render for CVE-2026-91808. Correlate with the opened file's origin.

Splunk SPL Query

index=windows (source="XmlWinEventLog:Application" OR EventCode=1000 OR EventCode=1001)
| search (Message="*Foxit*" OR FaultingApplicationName="*Foxit*")
| stats count values(Message) as crash_detail by host, FaultingApplicationName, FaultingModuleName
| where count > 0
| sort - count

Surfaces Windows application-crash telemetry involving Foxit binaries. Repeated crashes tied to a common document source warrant triage for CVE-2026-91808.

Wazuh OSSEC Rule

<group name="foxit,cve_2026_91808,">
  <rule id="100918" level="8">
    <decoded_as>windows_eventchannel</decoded_as>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.eventID">^1000$</field>
    <field name="win.eventdata.faultingApplicationPath">Foxit</field>
    <description>Foxit PDF application crash detected - possible CVE-2026-91808 exploitation via crafted PDF image object</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>cve_2026_91808,</group>
  </rule>
</group>

Tune the matching field against your actual Windows Application Error event schema; FIM monitoring on inbound PDF directories should be paired with this rule.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, no version range, and no workaround are recorded in tracked sources. Treat the following as compensating controls only.

1. Immediate mitigations

   • Restrict Foxit as the default PDF handler in high-risk workflows; consider an alternative reader with active memory-safety hardening where feasible.
   • Enforce attachment scanning via email gateway and endpoint AV for malformed PDF image objects; block or quarantine PDFs from untrusted external sources until their provenance is verified.
   • Disable automatic preview/handlers that render PDFs without a deliberate user action (e.g., explorer preview panes) to reduce accidental trigger surface.
   • Apply application-level exploit mitigations on endpoints (Windows Exploit Protection: ASLR, DEP, CFG) to harden the render path.

2. Patch/upgrade steps

   • Monitor the Foxit security advisories page for the CVE-2026-91808 fix and apply vendor updates the moment they publish. No fixed version string is available at the time of writing.
   • Once a patched build is released, inventory endpoints for the affected Foxit product lines and force-update through your software deployment tooling.
   • Re-test the document corpus after the update to confirm rendering behavior and crash telemetry returns to baseline.

3. Long-term hardening

   • Maintain a documented PDF reader patch SLA (e.g., critical updates within 72 hours of vendor release) and enforce it with configuration-management policy.
   • Run untrusted-document processing inside constrained environments — sandboxed viewers, disposable VMs, or low-privilege accounts with restricted network egress — to limit the blast radius of read and crash conditions.
   • Centralize and alert on application-crash telemetry (Windows Error Reporting / macOS crash logs) so recurring Foxit crashes by common file origin become visible.
   • Track CVE/CWE coverage for all installed document software, since image-decoding memory-safety issues in parsers are a recurring class.

References

• NVD — CVE-2026-91808: https://nvd.nist.gov/vuln/detail/CVE-2026-91808
• CWE-125: Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1204.002: User Execution — Malicious File — https://attack.mitre.org/techniques/T1204/002/
• Foxit Security Advisories (monitor for the CVE-2026-91808 fix release) — https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91808 not listed at time of writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign attribution and in-the-wild exploitation evidence: none available for CVE-2026-91808 at time of writing. No public PoC, no Nuclei template, no KEV listing.