CVE-2026-91809

Executive Summary

CVE-2026-91809 is a use-after-free (CWE-416) vulnerability in Foxit PDF Editor and Foxit PDF Reader affecting the processing of malformed PDF form fields. An attacker can trigger the flaw by enticing a user to open a crafted PDF document, causing improper validation during field-name traversal that leads the application to access a previously released object. Successful exploitation results in an application crash and, given the CVSS vector (C:H/I:H/A:H), potentially arbitrary code execution in the context of the user running the application. The vulnerability is currently unpatched with no public proof-of-concept, no Nuclei template, and no exploit code observed in tracked sources; it has not been added to CISA KEV and has not yet been scored by FIRST.org EPSS.

Technical Analysis

The vulnerability class is a use-after-free (CWE-416), a memory-safety defect in which a program continues to reference an object after that object has been freed. In CVE-2026-91809, the affected component is Foxit PDF Editor/Reader's handling of PDF form fields. Per the available description, improper validation during field-name traversal causes the application to access a released object, which results in an application crash.

At a class level, use-after-free conditions in document parsers typically arise when the parsing logic maintains references (pointers, handles, or index entries) into a data structure that is subsequently deallocated or reallocated during traversal. PDF form fields are organized as a hierarchical tree of field objects, each with a name component and references to related field nodes. Traversal of field names generally requires walking that hierarchy and dereferencing node state. If validation of a malformed field structure is insufficient, the traversal logic may continue to operate on a node that has already been released — for example, when a malformed or duplicate field-name path causes the parser to discard and free a node while a stale reference to it remains reachable.

Because the specific functions, methods, and code paths are not disclosed in the provided intelligence, no function names, file paths, or API parameters are asserted here. The mechanism is characterized strictly at the vulnerability-class level: a lifetime-management failure between the release of a form-field object and the later access of that object during field-name traversal.

Attack surface: the local file-parsing surface of Foxit PDF Editor/Reader. The application parses PDF documents, including their interactive form (AcroForm) structures, and the flaw is reachable during that parsing/traversal activity. The CVSS vector reflects this: AV:L (local access — the attacker must deliver a file to the target's system), UI:R (user interaction — the victim must open the document), and PR:N (no privileges required), with High impacts to confidentiality, integrity, and availability. The S:U scope indicates the impact is assessed to remain within the vulnerable application's security scope. On its own, a use-after-free that leads only to a crash would typically be scored primarily for availability impact; the High C/I/A ratings here indicate the assessment considers memory corruption severe enough to potentially be leveraged for code execution or other integrity/confidentiality loss. No exploit code exists publicly at the time of writing, and no patch has been published.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class and the NVD description. Because the description is sparse, only vulnerability-class-level detail is provided and no specific implementation artifacts are fabricated.

1. Reconnaissance / target identification. The attacker identifies users or organizations running vulnerable Foxit PDF Editor/Reader installations. Targets are typically knowledge workers who routinely open PDF attachments or downloaded documents (finance, legal, HR, engineering). No network service is targeted directly; the attacker's objective is to deliver a weaponized document.

2. Triggering the flaw. The attacker crafts a malicious PDF containing malformed form fields — specifically, a structure designed to exercise the field-name traversal logic with improper or unexpected field definitions. The exact malformed structure is not specified in available intelligence. Because the flaw is a use-after-free, the crafted input is intended to induce a state where a form-field object is released while a reference to it is still used during traversal.

3. Delivery and execution method (class level). The attacker delivers the PDF via phishing email attachment, a link to a hosted file, or a compromised website download. When the victim opens the document in a vulnerable Foxit product, the parsing/traversal path is exercised and the use-after-free condition is triggered. Depending on the state of the freed memory and any attacker-controlled reallocation, the outcome ranges from an application crash to further memory corruption. No specific heap-grooming technique or exploit primitive is asserted, because none is disclosed.

4. Post-exploitation impact (class level). A pure crash yields denial of service against the opened application. If the use-after-free is weaponizable (consistent with the High C/I/A CVSS subscores), the attacker could potentially achieve code execution in the context of the victim's user account, enabling data theft, document tampering, further payload installation, and lateral movement from the workstation.

Impact Assessment

Business impact centers on endpoint compromise via a common document format. Because Foxit PDF Editor/Reader is widely deployed on user workstations, the blast radius is the population of users who open untrusted PDFs. The CVSS base score of 7.8 (High) is driven by three High impact subscores — C:H, I:H, A:H — indicating potential loss of confidentiality, integrity, and availability. The vectors AV:L and UI:R mean exploitation requires local delivery and victim interaction (opening the file), which constrains mass remote exploitation but suits targeted phishing campaigns. PR:N means no authentication or elevated privileges are needed to trigger the flaw from the user's context. S:U indicates impact is confined to the vulnerable application's security authority. If code execution is achieved, an attacker inherits the victim user's permissions and access to sensitive documents, network shares, and stored credentials. Absent a patch, no remediation is available from the vendor, and no workaround has been documented; organizations must rely on compensating controls.

Detection Guidance

Sigma Rule

title: Potential Foxit PDF Reader/Editor Use-After-Free Exploitation Attempt
id: 8f3c2b1a-4d5e-6f70-8192-a3b4c5d6e7f8
status: experimental
description: Detects Foxit PDF Editor/Reader process crashes correlated with PDF document open events, indicative of CVE-2026-91809 use-after-free in form field handling.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91809
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
  - cve.2026-91809
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_crash:
    ExitCode: 3221225477
  condition: selection_img and selection_crash
falsepositives:
  - Legitimate application crashes unrelated to exploitation
level: medium

YARA Rule

rule CVE_2026_91809_Foxit_FormField_UAF
{
    meta:
        description = "Detects PDF documents with malformed form-field structures potentially targeting CVE-2026-91809"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91809"
        date = "2026-01-01"
    strings:
        $pdf_header = "%PDF-"
        $acroform   = "/AcroForm"
        $field      = "/Field"
        $parent     = "/Parent"
        $kids       = "/Kids"
        $tname      = "/T"
    condition:
        $pdf_header at 0 and $acroform and $field and 2 of ($parent, $kids, $tname)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91809 Potential Foxit PDF Malformed Form Field Delivery"; flow:established,to_client; http.response_body; content:"%PDF-"; content:"/AcroForm"; content:"/Field"; content:"/Kids"; distance:0; within:2048; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-91809; classtype:attempted-user; sid:202691809; rev:1;)

Elastic Detection

process where process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe")
and process.exit_code == 3221225477

Splunk SPL Query

index=endpoint (Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe" OR Image="*\\FoxitReader.exe")
| eval crash_exit=if(ExitCode=3221225477, 1, 0)
| where crash_exit=1
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image
| where count >= 1
| table first_seen, last_seen, ComputerName, User, Image, count

Wazuh OSSEC Rule

<group name="foxit,cve_2026_91809,">
  <rule id="202609" level="10">
    <if_sid>60009</if_sid>
    <field name="win.eventdata.image">Foxit(PDFReader|PDFEditor|Reader)\.exe</field>
    <field name="win.system.eventID">1000|1001</field>
    <description>CVE-2026-91809: Foxit PDF Editor/Reader application crash possibly due to malformed form field use-after-free</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>application_crash,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no vendor patch or workaround has been published, rely on compensating controls: restrict the opening of untrusted or unsolicited PDF documents, particularly email attachments; enforce email and web gateway inspection of PDFs, including static detection of malformed form-field structures; disable JavaScript in Foxit where feasible; and, for high-risk users, consider opening untrusted documents in an isolated, disposable environment (sandboxed VM or container) rather than on production workstations. Ensure endpoint detection coverage for Foxit process crashes (see Detection Guidance) to identify potential exploitation attempts.

2. Patch/upgrade steps. No patch exists. Monitor the vendor's official security bulletins and the NVD entry for CVE-2026-91809 for a fixed release. Once available, upgrade Foxit PDF Editor/Reader to the patched version across all endpoints, prioritizing users who routinely handle untrusted documents.

3. Long-term hardening. Maintain a vulnerability-management process that tracks document-parser CVEs and vendor advisory feeds; enforce least privilege so that a compromised PDF process operates with minimal rights; harden endpoints against memory-corruption exploitation (e.g., exploit protection/ASLR/DEP enforcement); segment networks to limit lateral movement from workstations; and conduct user awareness training on phishing delivery of weaponized documents.

References

• NVD — CVE-2026-91809: https://nvd.nist.gov/vuln/detail/CVE-2026-91809
• CWE-416: Use After Free — https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Foxit security advisories and product downloads: https://www.foxit.com/support/security-bulletins.html
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-91809 have been observed in available intelligence. The vulnerability has not been added to CISA KEV, no public PoC or exploit code is known, and no patch is available as of this report.