CVE-2026-91810

Executive Summary

CVE-2026-91810 is a heap-based out-of-bounds read (CWE-125) in Foxit PDF Editor and Foxit PDF Reader, triggered during rendering of PDF image masks with inconsistent metadata. An attacker can cause incorrect alpha-channel processing that leads to an out-of-bounds read and application crash. Any user who opens a crafted malicious PDF in an affected Foxit product is impacted; the primary confirmed effect is denial of service (crash), with a limited potential for memory disclosure (CVSS 6.1).

Technical Analysis

The vulnerability resides in Foxit's handling of malformed PDF image masks. PDF image masks (soft masks / SMask and stencil masks) carry metadata governing how per-pixel transparency or coverage is applied when an image object is composited onto the page. Per the NVD description, inconsistent image metadata causes the renderer to perform incorrect alpha-channel processing. The resulting computation derives a memory offset or length that exceeds the bounds of a heap-allocated buffer, producing a heap-based out-of-bounds read (CWE-125) during rendering.

The attack surface is the PDF rendering pipeline of Foxit PDF Editor and Foxit PDF Reader. The flaw is reachable when a document containing crafted image-mask metadata is parsed and rendered — no special privileges, authentication, or elevated context are required beyond the victim opening the file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) reflects that exploitation is local to the rendering process, low complexity, unauthenticated, and requires user interaction (opening the document).

The impact profile is bounded by the observed consequences: the out-of-bounds read corrupts renderer state or dereferences out-of-range heap memory, resulting in an application crash (A:H — high availability impact). The vector assigns C:L (low confidentiality impact), consistent with a limited potential for reading adjacent heap contents; there is no integrity impact (I:N) and no scope change (S:U) in the published assessment. No code-level function, class, or file-path details are disclosed in the available intelligence, so this analysis is constrained to the vulnerability class and rendering-stage mechanism described above.

Because patch confidence is 0/4 and no vendor fix is identified, affected versions cannot be enumerated and no remediation build exists as of this report.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available. The following chain is inferred strictly from the vulnerability class (heap-based out-of-bounds read in PDF image-mask alpha processing) and the NVD description; no implementation specifics are fabricated.

1. Reconnaissance / target identification. An attacker identifies targets running Foxit PDF Editor or Foxit PDF Reader. Delivery is content-centric rather than network-centric: the attacker needs a victim to open a crafted PDF. Attackers may profile victims via phishing lures, malicious email attachments, web-hosted document download links, or documents shared in collaborative/enterprise document workflows.

2. Triggering the flaw class. The attacker authors a PDF containing an image mask whose metadata is internally inconsistent — for example, mask dimensions, channel counts, or alpha parameters that conflict with the associated image's metadata. When the victim opens the document, Foxit's renderer processes the mask's alpha channel using the inconsistent metadata, computes an out-of-bounds offset/length, and reads beyond the allocated heap buffer.

3. Payload / execution method (vulnerability-class level). The payload is the malformed PDF document itself, delivered as a file attachment or download. No specific function names, API parameters, or file-structure keys beyond "image masks" are asserted, because the advisory does not disclose them. The trigger is the normal user action of opening/rendering the PDF.

4. Post-exploitation impact. The immediate outcome is a heap out-of-bounds read that crashes the application (availability impact). Because the vector rates confidentiality as low, an attacker may in principle obtain limited disclosure of adjacent heap memory as part of the out-of-range read; however, no evidence of weaponization, in-the-wild exploitation, or chained secondary impact (e.g., code execution) is present in the available data. There is no integrity impact per the published vector.

Impact Assessment

Business impact centers on user-facing disruption and potential minor information exposure from opening untrusted PDFs. Affected systems are endpoints running Foxit PDF Editor or Foxit PDF Reader — typically knowledge-worker desktops, shared workstations, and document-processing environments. Blast radius is per-endpoint and per-user: each instance where a victim opens a crafted file can crash the application. Repeated crash-triggering documents can cause workflow disruption and repeated session loss.

CVSS v3.1 subscores:

• Base score: 6.1 (Medium)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality: Low (C:L)
• Integrity: None (I:N)
• Availability: High (A:H)

The absence of a public exploit, no CISA KEV listing, and no assigned EPSS score indicate that the immediate operational risk is limited and driven primarily by targeted delivery of crafted PDFs. Enterprise risk rises if weaponization occurs or if the out-of-bounds read is chained with other memory-corruption primitives.

Detection Guidance

Sigma Rule

title: Foxit PDF Reader/Editor Crash from Malformed Image Mask (CVE-2026-91810)
id: 5f7c3a92-1d4e-4b8a-9f21-8c3b0d6e7a11
status: experimental
description: Detects abnormal termination of Foxit PDF Reader or Editor processes potentially caused by heap out-of-bounds read during image-mask rendering.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: windows
  category: process_termination
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\Foxit Reader.exe'
  selection_reason:
    - ExitCode: 3221225477   # 0xC0000005 access violation
    - ExitCode: 3221226356   # 0xC0000374 heap corruption
  condition: selection_image and selection_reason
fields:
  - Image
  - CommandLine
  - ExitCode
falsepositives:
  - Legitimate application crashes unrelated to malformed documents
level: medium

YARA Rule

rule CVE_2026_91810_Foxit_Malformed_ImageMask
{
    meta:
        author = "Threat Intelligence"
        description = "Detects PDF documents with image mask objects and inconsistent alpha/SMask metadata associated with CVE-2026-91810"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91810"
        date = "2026-01-01"

    strings:
        $pdf = "%PDF-"
        $smask = "/SMask"
        $s_mask = "/S /Alpha"
        $image = "/Subtype /Image"
        $mask = "/Mask"
        $bitspercomp = "/BitsPerComponent"
        $colorspace = "/ColorSpace"
        $decode = "/Decode"

    condition:
        $pdf at 0 and
        filesize < 20MB and
        ($smask or $mask or $s_mask) and
        $image and
        ($bitspercomp or $colorspace)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91810 Possible Foxit Malformed PDF Image Mask Download"; flow:established,to_client; file_data; content:"%PDF-"; content:"/SMask"; distance:0; content:"/Subtype /Image"; distance:0; filemagic:"PDF document"; filestore; sid:202691810; rev:1;)

Elastic Detection

process where event.type == "end" and
  process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "Foxit Reader.exe") and
  process.exit_code in (3221225477, 3221226356)

Splunk SPL Query

index=endpoint (process_name="FoxitPDFReader.exe" OR process_name="FoxitPDFEditor.exe" OR process_name="Foxit Reader.exe")
(exit_code=3221225477 OR exit_code=3221226356 OR signature="Access Violation" OR signature="Heap Corruption")
| stats count min(_time) as first_seen max(_time) as last_seen values(exit_code) as exit_codes values(file_name) as opened_files by host, user, process_name
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="windows,foxit,vulnerability,">
  <rule id="100810" level="8">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">\\\\Foxit.*\\.exe$</field>
    <field name="win.eventdata.exitCode">3221225477|3221226356</field>
    <description>CVE-2026-91810: Foxit PDF Reader/Editor abnormal termination likely caused by malicious image mask (heap OOB read).</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Treat PDFs from untrusted or unsolicited sources as hazardous; enforce attachment filtering and document sandboxing at the email and web gateways.
• Isolate Foxit document rendering in a sandboxed environment or dedicated low-privilege virtual machine.
• Disable or restrict automatic rendering/preview of PDF attachments in email clients and browsers to reduce inadvertent opening.
• Disable JavaScript in Foxit PDF Reader/Editor where not required, and consider disabling preview handlers for PDFs in file explorers.
• Restrict local log and crash-dump access; a limited-disclosure OOB read may otherwise leak adjacent heap contents into logs or dumps.

2. Patch/upgrade steps

• No vendor fix is available per tracked sources and no affected version range is enumerated. Monitor the Foxit security advisory channel for an updated release.
• When a patched build is published, inventory all endpoints running Foxit PDF Editor/Reader, prioritize production and internet-accessible user workstations, and deploy the updated version through standard software distribution.
• Validate post-upgrade by verifying the deployed build number against the vendor advisory.

3. Long-term hardening

• Standardize on a hardened PDF rendering configuration and maintain sandbox-based document inspection for all external documents.
• Implement centralized collection of application crash telemetry (exit codes 3221225477 / 3221226356) to detect clusters of Foxit crashes that may indicate a targeted campaign.
• Apply application allowlisting so only approved PDF readers execute.
• Maintain a vulnerability management workflow that integrates CVE feeds and enables rapid triage of unpatched client-side rendering flaws.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91810
• CWE-125: Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• Foxit Security Advisories (monitor for CVE-2026-91810): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score assigned as of this report): https://www.first.org/epss/

No public proof-of-concept, exploit code, or in-the-wild exploitation evidence is available. No threat actor campaign has been attributed to CVE-2026-91810.