CVE-2026-91811

Executive Summary

CVE-2026-91811 is a heap-based out-of-bounds write (CWE-787) in the PRC parser component of Foxit PDF Editor and Foxit Reader, caused by insufficient validation of vertex indices in triangular fan texture meshes. Because the vulnerability is reachable through a malicious PDF parsed by the affected application and requires user interaction to open the file, exploitation leads to memory corruption and application crash, with the potential for code execution in the context of the victim user. The vulnerability is unpatched as of this report, has no public proof-of-concept, no Nuclei template, and no evidence of exploitation in the wild (not in CISA KEV); CVSS 3.1 base score is 7.8 (High).

Technical Analysis

The vulnerable component is the PRC parser inside Foxit PDF Editor and Foxit Reader. PRC (Product Representation Compact) is a 3D data format embedded in PDF documents; parsers for this format build mesh geometry from index buffers that reference entries in vertex position, normal, and texture coordinate arrays. This CVE arises specifically in the handling of triangular fan texture meshes: the parser reads vertex indices from the file and uses them to index memory, but performs insufficient validation of those indices before the write operation. The result is a heap-based out-of-bounds write (CWE-787): an attacker-controlled index value that exceeds the bounds of the allocated heap buffer causes data to be written outside the intended region.

From the data provided, the vulnerability class and mechanism are inferable, but the following are NOT specified and cannot be asserted: the exact code unit or function responsible, the exact size or alignment of the destination heap buffer, the byte width of the index field, whether the overrun is a fixed small offset or an arbitrary-distance write, and what object is corrupted (adjacent heap chunk metadata, a function pointer, or a data structure). No allocation sizes, struct layouts, or parser internals are disclosed in the NVD description or CNA title. Any claim about a particular corruptible object or a particular malformed field offset would be speculative and is deliberately omitted.

Key attack-surface characteristics derived from the CVSS vector (AV:L, AC:L, PR:N, UI:R, S:U, C:H/I:H/A:H): the attack vector is Local, meaning the vulnerable parser is not exposed over the network — the attacker must deliver a document (typically a PDF containing an embedded PRC 3D mesh) and the victim must open it. Privileges are not required (PR:N), but user interaction is required (UI:R). Impact confidentiality, integrity, and availability are all High, which is consistent with arbitrary memory corruption rather than a pure denial-of-service fault: the write occurs under attacker influence and can be leveraged to control data the application subsequently uses. AC:L indicates the flaw is reliably triggerable given a crafted input, not that it requires a race condition or unusual state.

The absence of affected version ranges, patch sources, vendor fix, and workaround data means the exact set of vulnerable builds is undocumented in this dataset. Consequently, remediation must be driven by checking the installed Foxit build against the vendor's own advisory once published, rather than by relying on a version bound stated here.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-91811, and no affected versions, function names, or file-format field offsets are disclosed in the available data. The attack chain below is therefore described at the vulnerability-class level, with specific implementation details intentionally omitted.

1. Reconnaissance and target identification. The adversary identifies victims who use Foxit PDF Editor or Foxit Reader to open untrusted documents — for example, users who routinely receive PDFs from external parties. Targets of interest are workstations where the PDF reader parses documents automatically or where macro- or attachment-based phishing is viable. No network-accessible service is involved; the delivery vehicle is the document itself.

2. Triggering the flaw class. The attacker crafts a PDF containing an embedded 3D PRC object that includes a triangular fan texture mesh whose vertex indices are outside the valid range. When the victim opens the document, the Foxit PRC parser processes the mesh; because vertex indices are insufficiently validated, an index is used in a way that causes a heap-based out-of-bounds write. Triggering therefore depends on the victim opening the document (UI:R), not on any pre-existing privilege (PR:N).

3. Payload and execution method. Because no code-level details are published, the precise construction of the crafted index value or the surrounding mesh structure cannot be stated. At the class level, the out-of-bounds write allows the attacker to overwrite memory adjacent to the parser's heap allocation. Depending on what resides adjacent in the heap, this can corrupt control data the process later uses; whether that can be converted into reliable code execution or only into a crash is not established by the available data. Historically, an unrestricted heap write of this class is a viable path to code execution in the victim user's context, but a definitive exploitability claim for this CVE would be unsupported by the data supplied.

4. Post-exploitation impact. If code execution is achieved, the adversary operates with the privileges of the user running Foxit, which in many enterprise deployments is the interactive user account. From there, standard post-exploitation objectives apply: credential access, lateral movement, persistence, and data exfiltration. If code execution is not achieved, the demonstrated impact is memory corruption leading to an application crash — a denial-of-service condition against the reading session. The CVSS impact subscores (C:H/I:H/A:H) reflect the potential rather than the demonstrated outcome, consistent with the high-severity memory-corruption class.

Because the flaw is unpatched and no detection signature exists, defenders should treat any PDF carrying embedded PRC 3D content from an untrusted source as a potential exploitation attempt.

Impact Assessment

Business impact is concentrated on endpoint users who view PDF documents with Foxit PDF Editor or Foxit Reader. The CVSS 3.1 vector yields a base score of 7.8 (High) with the following subscores: attack vector Local (the document must be opened locally rather than delivered over the network), attack complexity Low (the crafted condition is reliably reproducible given the malformed mesh), privileges required None, user interaction Required (the victim must open the document), scope Unchanged (the impact stays within the application's security context), and confidentiality, integrity, and availability impacts all High.

The blast radius is potentially broad in organizations that standardize on Foxit for document review, because PDF is a ubiquitous business format and the delivery path — an email attachment, a downloaded file, or a shared drive document — is routine. The defect is in the document-parsing path, so any document containing a malicious PRC 3D mesh can reach it; content handling is limited to the client. Where the writing process runs with administrative rights or on a shared/Terminal Services host, the potential impact is correspondingly amplified, but that depends on local configuration and is not specific to this CVE.

Because exploitation requires the user to open a crafted file, the vulnerability is primarily a client-side document threat rather than a remote network threat. A successful memory-corruption write could, in the worst case, permit code execution as the user, enabling credential theft, lateral movement, and further payload deployment. Absent a reliable exploit, the more immediate operational effect is unexpected termination or instability of the reader, which can disrupt document workflows and, in some environments, cause loss of unsaved work. The primary metric of concern is that the vulnerability is unpatched at the time of this report, meaning exposure persists until the vendor ships a fix.

Detection Guidance

Sigma Rule

This rule detects suspicious child-process behavior following Foxit PDF Editor/Reader execution, a common post-exploitation pattern after client-side document exploitation.

title: Suspicious Child Process Spawned by Foxit PDF Reader or Editor
id: 7c1e4b2a-9f3d-4a6e-8b21-5d0f6a2c9e11
status: experimental
description: Detects suspicious process creation originating from Foxit PDF Editor or Foxit Reader, which may indicate client-side exploitation of a document parsing vulnerability.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91811
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_susp_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_susp_child
falsepositives:
  - Legitimate PDF-embedded actions authorized by the document
  - IT administration scripts launched manually from a Foxit session
level: high

YARA Rule

This rule flags PDF files containing PRC 3D mesh content, useful for identifying candidate malicious documents in mail or file repositories.

rule EXPL_CVE_2026_91811_PRCParser_Mesh
{
    meta:
        description = "Detects PDF documents embedding PRC 3D mesh content associated with CVE-2026-91811"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91811"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pdf = { 25 50 44 46 2D }                      // %PDF-
        $prc = "PRC" ascii nocase
        $ifc = "IFC" ascii nocase
        $mesh = "mesh" ascii nocase
        $tri = "tri" ascii nocase

    condition:
        $pdf at 0 and filesize < 50MB and
        (2 of ($prc, $ifc, $mesh, $tri))
}

Suricata IDS Rule

Network detection of a PDF containing embedded PRC 3D content traversing HTTP or SMTP. No CVE-specific byte signature is published, so this rule alerts on the delivery of PRC-bearing PDFs for analyst triage.

alert http any any -> any any (msg:"FILE-PDF Foxit PRC 3D content delivery possibly related to CVE-2026-91811"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"PRC"; nocase; within:8192; content:"IFC"; nocase; within:8192; filestore; sid:202691811; rev:1; classtype:attempted-user; reference:cve,2026-91811; metadata:service http;)

alert smtp any any -> any any (msg:"FILE-PDF Foxit PRC 3D content in email attachment possibly related to CVE-2026-91811"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"PRC"; nocase; within:8192; content:"IFC"; nocase; within:8192; filestore; sid:202691812; rev:1; classtype:attempted-user; reference:cve,2026-91811; metadata:service smtp;)

Elastic Detection

This EQL rule correlates a Foxit process spawning an unusual interpreter or binary, a post-exploitation signal consistent with a weaponized document.

process where event.type == "start" and
  process.parent.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                   "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
                   "certutil.exe")

Splunk SPL Query

Detects suspicious process execution under a Foxit PDF reader/editor parent process.

index=endpoint EventCode=1
| eval parent=lower(coalesce(ParentImage, parent_process_name))
| eval child=lower(coalesce(Image, process_name))
| where (like(parent, "%foxitpdfreader.exe") OR like(parent, "%foxitpdfeditor.exe") OR like(parent, "%foxitreader.exe"))
    AND (like(child, "%cmd.exe") OR like(child, "%powershell.exe") OR like(child, "%pwsh.exe")
         OR like(child, "%wscript.exe") OR like(child, "%cscript.exe") OR like(child, "%mshta.exe")
         OR like(child, "%rundll32.exe") OR like(child, "%regsvr32.exe") OR like(child, "%certutil.exe"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, parent, child
| sort - first_seen

Wazuh OSSEC Rule

Detects Foxit PDF reader spawning a shell or scripting interpreter, and the opening of PRC-bearing PDFs, mapped to CVE-2026-91811.

<group name="windows,sysmon,foxit,cve-2026-91811,">
  <rule id="2026911" level="12">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.parentImage">(?i)foxit(pdfreader|pdfeditor|reader)\.exe$</field>
    <field name="win.eventdata.image">(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$</field>
    <description>CVE-2026-91811: Suspicious child process spawned by Foxit PDF reader/editor</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve-2026-91811,process_creation,</group>
  </rule>

  <rule id="2026912" level="6">
    <if_group>sysmon_event11</if_group>
    <field name="win.eventdata.targetFilename">(?i)\.pdf$</field>
    <field name="win.eventdata.image">(?i)foxit(pdfreader|pdfeditor|reader)\.exe$</field>
    <description>CVE-2026-91811: Foxit opening a PDF document - potential vector for PRC parser exploitation</description>
    <group>cve-2026-91811,file_event,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix and no workarounds are documented in the available data, and no affected version ranges are published. The following measures reduce exposure until a fix is released; they are compensating controls, not a remediation of the root cause.

1. Immediate mitigations

• Treat PDF documents containing embedded PRC/3D content from untrusted sources as potentially malicious. Block or sandbox such attachments at the email gateway and web proxy where business needs allow, and strip embedded 3D objects where it is feasible to do so without breaking required content.
• Enable and enforce Protected View (or an equivalent untrusted-document mode) in Foxit PDF Editor and Reader so that documents from the internet, email, or other untrusted locations are parsed with reduced privileges where the product supports it.
• Limit the blast radius by running Foxit without local administrative rights and by applying least privilege to interactive users.
• Harden endpoints with exploit protection features (for example, Windows Defender Exploit Guard / Attack Surface Reduction) that constrain unexpected code execution from document readers.
• Monitor the logs and alerts generated by the detection guidance above for PDF-carried activity and Foxit process anomalies, since detection, not prevention, may be the practical first line of defense for an unpatched client-side parser flaw.

2. Patch and upgrade steps

• Monitor the Foxit security advisory channels and the NVD record for CVE-2026-91811. Because no patch evidence exists in any tracked source, no version can currently be recommended as fixed.
• When Foxit publishes a fixed build, validate it against the vendor advisory, deploy through normal software management, and verify the installed version across all endpoints on which Foxit PDF Editor or Reader is present.
• Re-test any compensating controls after the upgrade to avoid leaving document-handling functions disabled unnecessarily.

3. Long-term hardening

• Maintain an inventory of PDF-handling software across the estate so that future Foxit advisories can be mapped to exposed endpoints quickly.
• Adopt a routine of validating documents from external parties in an isolated environment before opening them on production endpoints.
• Keep exploit protections and endpoint detection tooling current, and rehearse response to client-side document exploitation so that Analyst triage of PDF-borne attacks is fast and consistent.

References

• NVD — CVE-2026-91811: https://nvd.nist.gov/vuln/detail/CVE-2026-91811
• CWE-787, Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91811 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-91811 in the data provided, and there is no evidence of exploitation in the wild or association with a known threat actor campaign.